CVE-2021-43798

CVE-2021-43798 is a path traversal flaw (CWE-22) in Grafana's plugin-serving endpoint that allows unauthenticated remote attackers to read arbitrary files from the server's local filesystem. It is triggered by crafted HTTP requests to the /public/plugins/<plugin-id>/ path, where the traversal payload can use any installed plugin's ID, and no authentication or user interaction is required. An attacker gains read access to local files on the Grafana host, which can expose configuration files, credentials, and other sensitive data (confidentiality impact only; no integrity or availability impact). Self-managed Grafana installations running versions 8.0.0-beta1 through 8.3.0 (other than the patched releases) are affected; Grafana Cloud was never vulnerable. Exploitation is well established: a public proof-of-concept exists, exploitation probability is very high (EPSS 88.5%, 100th percentile), and CISA added the flaw to its Known Exploited Vulnerabilities catalog on 2025-10-09.

What to do: Upgrade self-managed Grafana to 8.0.7, 8.1.8, 8.2.7, or 8.3.1 (or any later patched release); Grafana Cloud customers need take no action. Until patched, restrict or monitor access to /public/plugins/ and inspect web server, proxy, and Grafana access logs for traversal sequences against any installed plugin ID to detect file-read attempts. As a CISA KEV entry, federal agencies must apply vendor mitigations per BOD 22-01 guidance or discontinue use if patching is not possible.