All vulnerabilities
CVE-2021-43798BIT-grafana-2021-43798GHSA-8pjx-jj86-j47p

Grafana Path Traversal Vulnerability

Grafana Labs GrafanaGoApplications & CMS
Open in ThreatlineRecord JSON
CVSS
7.5High
ExploitationExploited in the wildAdded to KEV 9 Oct 2025CISA KEV
Exploit odds (EPSS)88.5%Chance of exploitation activity in the next 30 days, higher than 99% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in8.3.1Also 8.2.7, 8.1.8 and 1 moreGitHub
Federal deadline30 Oct 2025Remediation due date for US federal agenciesCISA KEV
CISA required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. CISA KEV

What fixes it

  • 8.3.1Path parser & escaping, grafanaGitHub
  • 8.2.7Path parser & escaping, grafanaGitHub
  • 8.1.8Path parser & escaping, grafanaGitHub
  • 8.0.7Path parser & escaping, grafanaGitHub
  • 8.3.1github.com/grafana/grafana, GoOSVgo get github.com/grafana/grafana@v8.3.1
  • 8.2.7github.com/grafana/grafana, GoOSVgo get github.com/grafana/grafana@v8.2.7
Show all 8 fixed versions
  • 8.1.8github.com/grafana/grafana, GoOSVgo get github.com/grafana/grafana@v8.1.8
  • 8.0.7github.com/grafana/grafana, GoOSVgo get github.com/grafana/grafana@v8.0.7

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Timeline

  1. 2 Dec 2021Exploit code publicMetasploit
  2. 7 Dec 2021, 18:25 UTCPublishedCVE List
  3. 9 Oct 2025Added to CISA KEVCISA KEV

Public exploit code and templates 3

  • Auxiliary moduleGrafana Plugin Path Traversal 2 Dec 2021Metasploit
  • Webapps exploitGrafana 8.3.0 - Directory Traversal and Arbitrary File Read 9 Dec 2021Exploit-DB
  • Scanner templateGrafana v8.x - Arbitrary File ReadNuclei

Listed so defenders can prioritize. Threatline links to the source and does not host exploit code.

Description

Grafana contains a path traversal vulnerability that could allow access to local files.

Text from CVE List

Affected versions 9

  • grafanaaffected: >= 8.0.0, < 8.0.7CVE List
  • grafanaaffected: >= 8.1.0, < 8.1.8CVE List
  • grafanaaffected: >= 8.2.0, < 8.2.7CVE List
  • grafanaaffected: = 8.3.0CVE List
  • Path parser & escaping, grafana8.0.0 - 8.3.0GitHub
  • github.com/grafana/grafana, Gofrom 8.3.0, fixed in 8.3.1OSV
  • github.com/grafana/grafana, Gofrom 8.2.0, fixed in 8.2.7OSV
  • github.com/grafana/grafana, Gofrom 8.1.0, fixed in 8.1.8OSV
  • github.com/grafana/grafana, Gofrom 8.0.0-beta1, fixed in 8.0.7OSV

References 7