VulnTideExploited vulnerabilities, by vendor. Data as of .
Known exploitedIn CISA's KEV catalog since Ransomware use: unknown
Grafana Labs Grafana

CVE-2021-43798: Grafana Path Traversal Vulnerability

Is it exploited?

Yes. CISA added it to the Known Exploited Vulnerabilities catalog on , 1,402 days after the CVE record was published.

How likely is exploitation in the next 30 days?
88.5%

EPSS score, percentile 99.8 of all scored records

How severe?
7.5 High

CVSS v3.1 base score, given by the CNA

What should I do?

CISA deadline . Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

The CVE record links no vendor advisory, patch or mitigation.

Which versions are affected?

Affected

  • >= 8.0.0, < 8.0.7
  • >= 8.1.0, < 8.1.8
  • >= 8.2.0, < 8.2.7
  • = 8.3.0

Versions by product

Source: CISA Known Exploited Vulnerabilities (KEV) catalog, 2026.10.28, as of ; FIRST Exploit Prediction Scoring System (EPSS), v2026.06.15, as of ; CVE List V5 (CVE Program), cve_2026-10-28_0000Z, as of . About the data.

What to do

Required action, set by CISA

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

CISA due date for this action: .

Advisories and patches

The CVE record links no vendor advisory, patch or mitigation.

Linked from CISA's catalog entry

Affected products and versions

As listed in the CVE record.

grafana grafana
StatusVersions
Affected>= 8.0.0, < 8.0.7
Affected>= 8.1.0, < 8.1.8
Affected>= 8.2.0, < 8.2.7
Affected= 8.3.0

Source: CVE List V5 (CVE Program), cve_2026-10-28_0000Z, as of . About the data.

About this vulnerability

Grafana contains a path traversal vulnerability that could allow access to local files.

Summary: CISA's KEV catalog, as of .

  • CISA added CVE-2021-43798 to its Known Exploited Vulnerabilities (KEV) catalog on 9 Oct 2025.
  • CISA's ransomware flag for this entry is "Unknown": no evidence of ransomware use in the catalog, which is not proof of none.
  • The due date CISA sets for the required action is 30 Oct 2025.
  • The CVE record was published on 7 Dec 2021, 1,402 days before it was added to KEV.
  • The CVE record carries a CVSS v3.1 base score of 7.5 (High), given by its CNA.
  • FIRST's EPSS model puts the probability of exploitation in the next 30 days at 88.5% (percentile 99.8), as of 28 Oct 2026.
  • CISA's SSVC assessment in the CVE record: exploitation active, automatable yes, technical impact partial.

Source: CISA Known Exploited Vulnerabilities (KEV) catalog, 2026.10.28, as of ; CVE List V5 (CVE Program), cve_2026-10-28_0000Z, as of ; FIRST Exploit Prediction Scoring System (EPSS), v2026.06.15, as of . About the data.

Description

Grafana path traversal

Grafana is an open-source platform for monitoring and observability. Grafana versions 8.0.0-beta1 through 8.3.0 (except for patched versions) iss vulnerable to directory traversal, allowing access to local files. The vulnerable URL path is: `<grafana_host_url>/public/plugins//`, where is the plugin ID for any installed plugin. At no time has Grafana Cloud been vulnerable. Users are advised to upgrade to patched versions 8.0.7, 8.1.8, 8.2.7, or 8.3.1. The GitHub Security Advisory contains more information about vulnerable URL paths, mitigation, and the disclosure timeline.

Source: CVE List V5 (CVE Program), cve_2026-10-28_0000Z, as of . About the data.

Weakness

  • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CWE and CAPEC are maintained by MITRE; the entries are those named in the CVE record and the KEV entry.

Timeline

DateEvent
CVE record published
Added to CISA KEV
CVE record last updated
CISA due date for the required action

References

More exploited Grafana vulnerabilities

  • CVE-2021-39226: Grafana Authentication Bypass Vulnerability (added )