CVE-2021-43798 Grafana Path Traversal
Attackers can read local files via directory traversal in Grafana plugin URLs, exposing sensitive system data.
- Exploited in the wild
- Since 9 Oct 2025
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-43798?
CVE-2021-43798 is a high-severity path traversal vulnerability in Grafana Grafana, published on 7 Dec 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Grafana is an open-source platform for monitoring and observability. Grafana versions 8.0.0-beta1 through 8.3.0 (except for patched versions) iss vulnerable to directory traversal, allowing access to local files. The vulnerable URL path is: `<grafana_host_url>/public/plugins//`, where is the plugin ID for any installed plugin. At no time has Grafana Cloud been vulnerable. Users are advised to upgrade to patched versions 8.0.7, 8.1.8, 8.2.7, or 8.3.1. The GitHub Security Advisory contains more information about vulnerable URL paths, mitigation, and the disclosure timeline.
Weakness: CWE-22
Which versions are affected by CVE-2021-43798?
9 open source packages ship an affected version, including github.com/grafana/grafana and grafana. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/grafana/grafana Go | From 8.0.0-beta1 | 8.0.7 |
github.com/grafana/grafana Go | From 8.0.0-beta1 | 8.0.7 |
github.com/grafana/grafana Go | From 8.1.0 | 8.1.8 |
github.com/grafana/grafana Go | From 8.1.0 | 8.1.8 |
github.com/grafana/grafana Go | From 8.2.0 | 8.2.7 |
github.com/grafana/grafana Go | From 8.2.0 | 8.2.7 |
3 more packages
github.com/grafana/grafana Go | From 8.3.0 | 8.3.1 |
github.com/grafana/grafana Go | From 8.3.0 | 8.3.1 |
grafana Bitnami | From 8.0.1 | 8.0.7, 8.1.8, 8.2.7, 8.3.1 |
Products include Grafana Grafana.
How do I fix CVE-2021-43798?
Upgrade github.com/grafana/grafana to a fixed version for your release line: 8.0.7, 8.1.8, 8.2.7 or 8.3.1. US federal agencies must fix it by 30 Oct 2025.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2021-43798 being exploited?
Yes. Attackers have exploited CVE-2021-43798 in the wild since at least 9 Oct 2025.
Public exploit code: 1 Metasploit module, 1 Exploit-DB entry, 1 Nuclei template and 58 proofs of concept on GitHub.
Other vulnerabilities in Grafana Grafana
Sources
Also known as BIT-grafana-2021-43798, GHSA-8pjx-jj86-j47p.