Grafana is an open-source platform for monitoring and observability. Grafana versions 8.0.0-beta1 through 8.3.0 (except for patched versions) iss vulnerable to directory traversal, allowing access to local files. The vulnerable URL path is: `<grafana_host_url>/public/plugins//`, where is the plugin ID for any installed plugin. At no time has Grafana Cloud been vulnerable. Users are advised to upgrade to patched versions 8.0.7, 8.1.8, 8.2.7, or 8.3.1. The GitHub Security Advisory contains more information about vulnerable URL paths, mitigation, and the disclosure timeline.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade grafana | Aug 22, 2024 | Dec 7, 2021 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Dec 7, 2021 |
| Freebsd | — | Upgrade grafanaUpgrade grafana8 | Nov 4, 2022 | Dec 11, 2021 |
| Suse | — | Upgrade spacecmdUpgrade golang-github-prometheus-node_exporterUpgrade prometheus-blackbox_exporterUpgrade wireUpgrade golang-github-boynux-squid_exporterUpgrade golang-github-prometheus-promuUpgrade grafanaUpgrade python3-rhnlibUpgrade dracut-saltbootUpgrade prometheus-postgres_exporter | Oct 26, 2022 | Dec 7, 2021 |
| Ubuntu | — | No solution exists | Jun 26, 2025 | Dec 7, 2021 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub