CVE-2021-43798

Grafana is an open-source platform for monitoring and observability. Grafana versions 8.0.0-beta1 through 8.3.0 (except for patched versions) iss vulnerable to directory traversal, allowing access to local files. The vulnerable URL path is: `<grafana_host_url>/public/plugins//`, where is the plugin ID for any installed plugin. At no time has Grafana Cloud been vulnerable. Users are advised to upgrade to patched versions 8.0.7, 8.1.8, 8.2.7, or 8.3.1. The GitHub Security Advisory contains more information about vulnerable URL paths, mitigation, and the disclosure timeline.

• CWE-22

• http://packetstormsecurity.com/files/165198/Grafana-Arbitrary-File-Reading.htmlThird Party Advisory, VDB Entry
• http://packetstormsecurity.com/files/165221/Grafana-8.3.0-Directory-Traversal-Arbitrary-File-Read.htmlExploit, Third Party Advisory, VDB Entry
• http://www.openwall.com/lists/oss-security/2021/12/09/2Mailing List, Patch, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2021/12/10/4Mailing List, Patch, Third Party Advisory
• https://github.com/grafana/grafana/commit/c798c0e958d15d9cc7f27c72113d572fa58545cePatch, Third Party Advisory
• https://github.com/grafana/grafana/security/advisories/GHSA-8pjx-jj86-j47pPatch, Vendor Advisory
• https://grafana.com/blog/2021/12/08/an-update-on-0day-cve-2021-43798-grafana-directory-traversal/Vendor Advisory
• https://security.netapp.com/advisory/ntap-20211229-0004/Third Party Advisory
• http://packetstormsecurity.com/files/165198/Grafana-Arbitrary-File-Reading.htmlThird Party Advisory, VDB Entry
• http://packetstormsecurity.com/files/165221/Grafana-8.3.0-Directory-Traversal-Arbitrary-File-Read.htmlExploit, Third Party Advisory, VDB Entry
• http://www.openwall.com/lists/oss-security/2021/12/09/2Mailing List, Patch, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2021/12/10/4Mailing List, Patch, Third Party Advisory
• https://github.com/grafana/grafana/commit/c798c0e958d15d9cc7f27c72113d572fa58545cePatch, Third Party Advisory
• https://github.com/grafana/grafana/security/advisories/GHSA-8pjx-jj86-j47pPatch, Vendor Advisory
• https://grafana.com/blog/2021/12/08/an-update-on-0day-cve-2021-43798-grafana-directory-traversal/Vendor Advisory
• https://security.netapp.com/advisory/ntap-20211229-0004/Third Party Advisory
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-43798US Government Resource

Published

Dec 7, 2021

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-43791Zulip is an open source group chat application that combines…5.3
• CVE-2021-43792Discourse is an open source discussion platform. In affected…4.3
• CVE-2021-43793Discourse is an open source discussion platform. In affected…4.3
• CVE-2021-43794Discourse is an open source discussion platform. In affected…5.3
• CVE-2021-43795Armeria is an open source microservice framework. In affecte…7.5
• CVE-2021-43797Netty is an asynchronous event-driven network application fr…6.5
• CVE-2021-43799Zulip is an open-source team collaboration tool. Zulip Serve…9.8
• CVE-2021-4380The Pinterest Automatic plugin for WordPress is vulnerable t…9.8
• CVE-2021-43800Wiki.js is a wiki app built on Node.js. Prior to version 2.5…7.5
• CVE-2021-43801Mercurius is a GraphQL adapter for Fastify. Any users from M…7.5
• CVE-2021-43802Etherpad is a real-time collaborative editor. In versions pr…8.8
• CVE-2021-43803Next.js is a React framework. In versions of Next.js prior t…7.5