Database/Control plane, storage & DevOps
Grafana Git Sync: path traversal lets an Editor delete or move files outside the repository path
Impact
A user who can create Git Sync provisioning jobs (the Editor role by default) can delete or move files outside the configured repository path by referencing a resource whose source path contains ../ sequences. With a local filesystem repository, this reaches files on the Grafana host itself. That allows tampering with or destroying the monitoring server's own files, beyond the dashboards the user should control.
Who can reach it
An authenticated user allowed to create Git Sync provisioning jobs (Editor by default), over the network. Access to host files requires a repository backed by the local filesystem.
What to do
Upgrade Grafana to 13.0.4 or 13.1.1 or later (the versions the record names for the local filesystem case) and restart the Grafana server. See the Grafana advisory for other affected branches. Until you upgrade, avoid local filesystem Git Sync repositories and limit who can create provisioning jobs.
References
Related entries
- Apache Airflow: asset API reveals IDs of Dags the caller is not allowed to readCVE-2026-111454 · Apache Airflow (asset API endpoints)Medium
- Jenkins: symlink following during item rename discloses arbitrary controller filesCVE-2026-117615 · Jenkins core (item rename directory copy, symlink following)Medium
- ansible-pylibssh / ansible.netcommon: changed SSH host keys silently accepted when auto-add is onCVE-2026-126641 · ansible-pylibssh and ansible.netcommon libssh connection plugin (host key verification)Medium
- AWX: template admin can attach another user's webhook token and have it sent to a destination they controlCVE-2026-126642 · Red Hat Ansible Automation Platform / AWX (job template webhook credentials)Medium
- AAP Gateway Operator: resource-server secret copied in plaintext into the AutomationController custom resourceCVE-2026-126643 · Red Hat Ansible Automation Platform Gateway Operator (AutomationController reconciliation)Medium
- GitLab: group milestones API returns private-project milestone metadata without membershipCVE-2026-13319 · GitLab CE/EE group milestones API (project filter authorization)Medium
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.