CVE-2021-43798— Grafana path traversal
Quick assessment
Affected
grafana grafana
Exploitation
Confirmed exploitation in the wild; remediate immediately
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Grafana是Grafana实验室的一套提供可视化监控界面的开源监控工具。该工具主要用于监控和分析Graphite、InfluxDB和Prometheus等。 Grafana 8.0.0-beta1至8.3.0存在路径遍历漏洞，攻击者可利用该漏洞执行目录遍历攻击，访问本地文件。
Public Exploits 3
ExploitDB · 1
EDB-50581 [webapps]
Metasploit · 1
grafana_plugin_traversal.rb [auxiliary]
Nuclei · 1
CVE-2021-43798.yaml [template]
In-the-Wild Activity Observed
cisa_kev · confirmed
Possible ATT&CK Techniques 1 AI
T1552.001 · Credentials In Files
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2021-43798
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Grafana path traversal
Source: CVE Program / CVE List V5
Vulnerability Description
Grafana is an open-source platform for monitoring and observability. Grafana versions 8.0.0-beta1 through 8.3.0 (except for patched versions) iss vulnerable to directory traversal, allowing access to local files. The vulnerable URL path is: `<grafana_host_url>/public/plugins//`, where is the plugin ID for any installed plugin. At no time has Grafana Cloud been vulnerable. Users are advised to upgrade to patched versions 8.0.7, 8.1.8, 8.2.7, or 8.3.1. The GitHub Security Advisory contains more information about vulnerable URL paths, mitigation, and the disclosure timeline.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
对路径名的限制不恰当(路径遍历)
Source: CVE Program / CVE List V5
Vulnerability Title
Grafana 路径遍历漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Grafana是Grafana实验室的一套提供可视化监控界面的开源监控工具。该工具主要用于监控和分析Graphite、InfluxDB和Prometheus等。 Grafana 8.0.0-beta1至8.3.0存在路径遍历漏洞，攻击者可利用该漏洞执行目录遍历攻击，访问本地文件。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Shenlong Deep Dive — AI Deep Analysis
10-question deep dive: root cause, exploitation, mitigation, urgency. Read summary free, full version requires login.
Affected Products
II. Public POCs for CVE-2021-43798
| # | POC Description | Source Link | Shenlong Link |
|---|---|---|---|
| 1 | CVE-2021-43798 - Grafana 8.x Path Traversal (Pre-Auth) | https://github.com/taythebot/CVE-2021-43798 | POC Details |
| 2 | Grafana Arbitrary File Reading Vulnerability | https://github.com/zer0yu/CVE-2021-43798 | POC Details |
| 3 | Grafana Unauthorized arbitrary file reading vulnerability | https://github.com/jas502n/Grafana-CVE-2021-43798 | POC Details |
| 4 | CVE-2021-43798 Grafana 任意文件读取漏洞 POC+参数 | https://github.com/ScorpionsMAX/CVE-2021-43798-Grafana-POC | POC Details |
| 5 | CVE-2021-43798:Grafana 任意文件读取漏洞 | https://github.com/Mr-xn/CVE-2021-43798 | POC Details |
| 6 | Grafanav8.*版本任意文件读取漏洞批量检测工具：该漏洞目前为0day漏洞，未授权的攻击者利用该漏洞，能够获取服务器敏感文件。 | https://github.com/asaotomo/CVE-2021-43798-Grafana-Exp | POC Details |
| 7 | A exploit tool for Grafana Unauthorized arbitrary file reading vulnerability (CVE-2021-43798), it can burst plugins / extract secret_key / decrypt data_source info automatic. | https://github.com/A-D-Team/grafanaExp | POC Details |
| 8 | 利用grafan CVE-2021-43798任意文件读漏洞，自动探测是否有漏洞、存在的plugin、提取密钥、解密server端db文件，并输出data_sourrce信息。 | https://github.com/kenuosec/grafanaExp | POC Details |
| 9 | grafana CVE-2021-43798任意文件读取漏洞POC，采用多插件轮训检测的方法，允许指定单URL和从文件中读取URL | https://github.com/M0ge/CVE-2021-43798-grafana_fileread | POC Details |
| 10 | Grafana File-Read Vuln | https://github.com/JiuBanSec/Grafana-CVE-2021-43798 | POC Details |
| 11 | CVE-2021-43798-Grafana任意文件读取漏洞 | https://github.com/lfz97/CVE-2021-43798-Grafana-File-Read | POC Details |
| 12 | None | https://github.com/s1gh/CVE-2021-43798 | POC Details |
| 13 | Simple program for exploit grafana | https://github.com/z3n70/CVE-2021-43798 | POC Details |
| 14 | Grafana-POC任意文件读取漏洞(CVE-2021-43798) | https://github.com/Mo0ns/Grafana_POC-CVE-2021-43798 | POC Details |
| 15 | CVE-2021-43798Exp多线程批量验证脚本 | https://github.com/fanygit/Grafana-CVE-2021-43798Exp | POC Details |
| 16 | CVE-2021-43798 is a vulnerability marked as High priority (CVSS 7.5) leading to arbitrary file read via installed plugins in Grafana application. | https://github.com/LongWayHomie/CVE-2021-43798 | POC Details |
| 17 | This is a proof-of-concept exploit for Grafana's Unauthorized Arbitrary File Read Vulnerability (CVE-2021-43798). | https://github.com/pedrohavay/exploit-grafana-CVE-2021-43798 | POC Details |
| 18 | None | https://github.com/gixxyboy/CVE-2021-43798 | POC Details |
| 19 | Grafana8.x 任意文件读取 | https://github.com/Ryze-T/CVE-2021-43798 | POC Details |
| 20 | CVE-2021-43798 Grafana任意文件读取 | https://github.com/k3rwin/CVE-2021-43798-Grafana | POC Details |
| 21 | None | https://github.com/gps1949/CVE-2021-43798 | POC Details |
| 22 | None | https://github.com/halencarjunior/grafana-CVE-2021-43798 | POC Details |
| 23 | 运用golang写的grafana批量验证脚本，内置48个验证 | https://github.com/light-Life/CVE-2021-43798 | POC Details |
| 24 | Grafana8.x 任意文件读取 | https://github.com/rnsss/CVE-2021-43798-poc | POC Details |
| 25 | None | https://github.com/rodpwn/CVE-2021-43798-mass_scanner | POC Details |
| 26 | None | https://github.com/aymenbouferroum/CVE-2021-43798_exploit | POC Details |
| 27 | Script to demonstrate the Grafana directory traversal exploit (CVE-2021-43798). | https://github.com/Jroo1053/GrafanaDirInclusion | POC Details |
| 28 | This repository contains files for reproducing the vulnerability. | https://github.com/yasin-cs-ko-ak/grafana-cve-2021-43798 | POC Details |
| 29 | None | https://github.com/BJLIYANLIANG/CVE-2021-43798-Grafana-File-Read | POC Details |
| 30 | None | https://github.com/lalkaltest/CVE-2021-43798 | POC Details |
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2021-43798
请登录查看更多情报信息。
Patches & Fixes for CVE-2021-43798 (1)
Vendor Advisories for CVE-2021-43798 (1)
-
https://github.com/grafana/grafana/security/advisories/GHSA-8pjx-jj86-j47p x_refsource_CONFIRM
Exploits & Public PoCs for CVE-2021-43798 (2)
Mailing List Discussions for CVE-2021-43798 (2)
Security Blog Posts for CVE-2021-43798 (1)
IV. Related Vulnerabilities
Same product: grafana
-
CVE-2026-27879
Query resampling can cause unbounded memory allocations -
CVE-2026-28375
Grafana Testdata datasource can issue unbounded memory alloc -
CVE-2026-27876
RCE on Grafana via sqlExpressions -
CVE-2026-27880
OpenFeature evaluation API reads input data with no bounds -
CVE-2026-27877
Public dashboards discloses all direct mode datasources
Same weakness: CWE-22
-
CVE-2026-57171
Trestle is vulnerable to arbitrary file write via path trave -
CVE-2026-32637
Velero vulnerable to file path traversal when extracting fro -
CVE-2026-80104
DB-GPT 0.8.0 Path Traversal Arbitrary File Write via Skill U -
CVE-2026-65092
NVIDIA OpenShell Sandbox路径穿越绕过导致信息泄露 -
CVE-2026-55557
browse-mcp: Arbitrary file write via unconfined download and
V. Comments for CVE-2021-43798
No comments yet