{"schema":"threatline.record/2","record":{"id":"CVE-2021-43798","aliases":["BIT-grafana-2021-43798","GHSA-8pjx-jj86-j47p"],"summary":"Grafana Path Traversal Vulnerability","details":"Grafana contains a path traversal vulnerability that could allow access to local files.","categories":["Applications & CMS"],"product":"Grafana","vendor":"Grafana Labs","ecosystem":"Go","affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2021-43798","source_modified_at":"2025-10-21T23:25:24.009Z","fetched_at":"2026-10-23T18:42:43.628194Z","product":"grafana","vendor":"grafana","versions":[{"status":"affected","version":">= 8.0.0, < 8.0.7"},{"status":"affected","version":">= 8.1.0, < 8.1.8"},{"status":"affected","version":">= 8.2.0, < 8.2.7"},{"status":"affected","version":"= 8.3.0"}],"defaultStatus":null},{"source":"GitHub Advisory Database","source_url":"https://github.com/grafana/grafana/security/advisories/GHSA-8pjx-jj86-j47p","source_modified_at":"2021-12-08T15:46:02Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"grafana","name":"Path parser & escaping"},"range":"8.0.0 - 8.3.0"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-8pjx-jj86-j47p","source_modified_at":"2026-07-08T06:28:12.430689527Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"name":"github.com/grafana/grafana","ecosystem":"Go","purl":"pkg:golang/github.com/grafana/grafana"},"ranges":[{"type":"SEMVER","events":[{"introduced":"8.3.0"},{"fixed":"8.3.1"}]}],"versions":[]},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-8pjx-jj86-j47p","source_modified_at":"2026-07-08T06:28:12.430689527Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"name":"github.com/grafana/grafana","ecosystem":"Go","purl":"pkg:golang/github.com/grafana/grafana"},"ranges":[{"type":"SEMVER","events":[{"introduced":"8.2.0"},{"fixed":"8.2.7"}]}],"versions":[]},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-8pjx-jj86-j47p","source_modified_at":"2026-07-08T06:28:12.430689527Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"name":"github.com/grafana/grafana","ecosystem":"Go","purl":"pkg:golang/github.com/grafana/grafana"},"ranges":[{"type":"SEMVER","events":[{"introduced":"8.1.0"},{"fixed":"8.1.8"}]}],"versions":[]},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-8pjx-jj86-j47p","source_modified_at":"2026-07-08T06:28:12.430689527Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"name":"github.com/grafana/grafana","ecosystem":"Go","purl":"pkg:golang/github.com/grafana/grafana"},"ranges":[{"type":"SEMVER","events":[{"introduced":"8.0.0-beta1"},{"fixed":"8.0.7"}]}],"versions":[]}],"fixed_versions":[{"source":"GitHub Advisory Database","source_url":"https://github.com/grafana/grafana/security/advisories/GHSA-8pjx-jj86-j47p","source_modified_at":"2021-12-08T15:46:02Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"grafana","name":"Path parser & escaping"},"version":"8.3.1"},{"source":"GitHub Advisory Database","source_url":"https://github.com/grafana/grafana/security/advisories/GHSA-8pjx-jj86-j47p","source_modified_at":"2021-12-08T15:46:02Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"grafana","name":"Path parser & escaping"},"version":"8.2.7"},{"source":"GitHub Advisory Database","source_url":"https://github.com/grafana/grafana/security/advisories/GHSA-8pjx-jj86-j47p","source_modified_at":"2021-12-08T15:46:02Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"grafana","name":"Path parser & escaping"},"version":"8.1.8"},{"source":"GitHub Advisory Database","source_url":"https://github.com/grafana/grafana/security/advisories/GHSA-8pjx-jj86-j47p","source_modified_at":"2021-12-08T15:46:02Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"grafana","name":"Path parser & escaping"},"version":"8.0.7"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-8pjx-jj86-j47p","source_modified_at":"2026-07-08T06:28:12.430689527Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"name":"github.com/grafana/grafana","ecosystem":"Go","purl":"pkg:golang/github.com/grafana/grafana"},"version":"8.3.1"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-8pjx-jj86-j47p","source_modified_at":"2026-07-08T06:28:12.430689527Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"name":"github.com/grafana/grafana","ecosystem":"Go","purl":"pkg:golang/github.com/grafana/grafana"},"version":"8.2.7"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-8pjx-jj86-j47p","source_modified_at":"2026-07-08T06:28:12.430689527Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"name":"github.com/grafana/grafana","ecosystem":"Go","purl":"pkg:golang/github.com/grafana/grafana"},"version":"8.1.8"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-8pjx-jj86-j47p","source_modified_at":"2026-07-08T06:28:12.430689527Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"name":"github.com/grafana/grafana","ecosystem":"Go","purl":"pkg:golang/github.com/grafana/grafana"},"version":"8.0.7"}],"cvss":7.5,"severity":"High","kev":{"listed":true,"date_added":"2025-10-09","due_date":"2025-10-30","required_action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomware_campaign_use":"Unknown"},"epss":{"probability":0.88503,"percentile":0.99775,"score_date":"2026-10-23"},"published_at":"2021-12-07T18:25:10.000Z","modified_at":"2026-07-08T06:28:12.430689527Z","provenance":[{"source":"CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23T17:00:09.9001Z"},{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2021-43798","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2025-10-21T23:25:24.009Z"},{"source":"GitHub Advisory Database","url":"https://github.com/grafana/grafana/security/advisories/GHSA-8pjx-jj86-j47p","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2021-12-08T15:46:02Z"},{"source":"OSV","url":"https://osv.dev/vulnerability/GHSA-8pjx-jj86-j47p","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-07-08T06:28:12.430689527Z"},{"source":"Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/http/grafana_plugin_traversal.rb","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2021-12-02"},{"source":"Exploit-DB","url":"https://www.exploit-db.com/exploits/50581","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2021-12-09"},{"source":"Nuclei","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-43798.yaml","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":null},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-43798","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["CISA KEV","CVE List","GitHub Advisory Database","OSV","Metasploit","Exploit-DB","Nuclei","EPSS"],"references":[{"url":"https://grafana.com/blog/2021/12/07/grafana-8.3.1-8.2.7-8.1.8-and-8.0.7-released-with-high-severity-security-fix/","source":"CISA KEV"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-43798","source":"CISA KEV"},{"source":"CVE List","url":"https://github.com/grafana/grafana/security/advisories/GHSA-8pjx-jj86-j47p","tags":["x_refsource_CONFIRM","x_transferred"]},{"source":"CVE List","url":"https://github.com/grafana/grafana/commit/c798c0e958d15d9cc7f27c72113d572fa58545ce","tags":["x_refsource_MISC","x_transferred"]},{"source":"CVE List","url":"https://grafana.com/blog/2021/12/08/an-update-on-0day-cve-2021-43798-grafana-directory-traversal/","tags":["x_refsource_CONFIRM","x_transferred"]},{"source":"CVE List","url":"https://security.netapp.com/advisory/ntap-20211229-0004/","tags":["x_refsource_CONFIRM","x_transferred"]},{"source":"CVE List","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-43798","tags":["government-resource"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","ssvc":{"exploitation":"active","automatable":"yes","technical_impact":"partial","assessed_at":"2025-10-09T03:55:40.438037Z"},"exploits":[{"source":"Metasploit","kind":"Auxiliary module","name":"Grafana Plugin Path Traversal","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/http/grafana_plugin_traversal.rb","date":"2021-12-02","added":"2026-04-02","check":false},{"source":"Exploit-DB","kind":"Webapps exploit","name":"Grafana 8.3.0 - Directory Traversal and Arbitrary File Read","url":"https://www.exploit-db.com/exploits/50581","date":"2021-12-09","added":"2021-12-09","verified":false},{"source":"Nuclei","kind":"Scanner template","name":"Grafana v8.x - Arbitrary File Read","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-43798.yaml"}],"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"product","confidence":"heuristic","reviewed":false},"change_timestamp":"2026-07-08T06:28:12.430689527Z","content_hash":"0b05c7e6e810c68cd09b61f79e0678bf54f0e5823d6bb6bd2068292eb685b224"}}