CVE-2021-43813: Directory Traversal in Grafana
Vulnerability summary
CVE-2021-43813 is a medium (CVSS 4.3) vulnerability in grafana. EPSS estimates a 56.59% chance of exploitation in the next 30 days, higher than 99% of scored vulnerabilities.
Not severe (CVSS 4.3, network access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 13 · Related 13Timeline
- 10-12-2021PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
Grafana is an open-source platform for monitoring and observability. Grafana prior to versions 8.3.2 and 7.5.12 contains a directory traversal vulnerability for fully lowercase or fully uppercase .md files. The vulnerability is limited in scope, and only allows access to files with the extension .md to authenticated users only. Grafana Cloud instances have not been affected by the vulnerability. Users should upgrade to patched versions 8.3.2 or 7.5.12. For users who cannot upgrade, running a reverse proxy in front of Grafana that normalizes the PATH of the request will mitigate the vulnerability. The proxy will have to also be able to handle url encoded paths. Alternatively, for fully lowercase or fully uppercase .md files, users can block /api/plugins/.*/markdown/.* without losing any functionality beyond inlined plugin help text.
CVSS metrics
6 scores · 5 sources · 2 versions- OSV · Red hatEcosystem advisory · calculated4.3MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
- OSV · UbuntuEcosystem advisory · calculated4.3MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
- NVDNIST4.3MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
- OSV · AlpineEcosystem advisory · calculated4.3MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
EPSS trend
Probability
56.59%
Chance of exploitation in the next 30 days
Percentile
99%
Versus all other CVEs
30-day change
Decrease -1.40 pp
From 57.99% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Known conditions: network-reachable, low-privilege account, no user interaction (CVSS vector). Other conditions: not stated in public data.
Redhat2 products
- grafana< 0:7.5.11-2.el8
- grafana-debuginfo< 0:7.5.11-2.el8
Alpine1 product
- grafana≥ 5.0.0, < 8.3.2-r0
Grafana1 product
- grafana≥ 5.0.0, < 7.5.12 | ≥ 8.0.0, < 8.3.2
Opensuse1 product
- grafana&distro=openSUSE Tumbleweed< 7.5.12-1.1
Ubuntu1 product
- grafanaAll versions (No fix recorded)
5 vendors · 6 products
References
20 links- github.com/grafana/grafana/security/advisories/GHSA-c3q8-26ph-9g2qX Refsource CONFIRMREPORTPatchRelease NotesThird Party Advisory
- github.com/github/securitylab-vulnerabilities/commit/689fc5d9fd665be4d5bba200a6a433b532172d0fX Refsource MISCREPORTBroken Link
- github.com/grafana/grafana/commit/fd48aee61e4328aae8d5303a9efd045fa0ca308dX Refsource MISCREPORTPatchThird Party Advisory
- grafana.com/blog/2021/12/10/grafana-8.3.2-and-7.5.12-released-with-moderate-severity-security-fix/X Refsource MISCARTICLEREPORTPatchRelease NotesVendor Advisory
- grafana.com/docs/grafana/latest/release-notes/release-notes-7-5-12/X Refsource MISCREPORTRelease NotesVendor Advisory
- grafana.com/docs/grafana/latest/release-notes/release-notes-8-3-2/X Refsource MISCREPORTRelease NotesVendor Advisory
- www.openwall.com/lists/oss-security/2021/12/10/4Mailing ListX Refsource MLISTREPORTPatchRelease NotesThird Party Advisory
