Grafana Path Traversal (CVE‑2021‑43798) Allows Local File Access
What It Is — Grafana Labs’ Grafana contains a path‑traversal flaw (CVE‑2021‑43798) that permits an unauthenticated attacker to request arbitrary files from the host filesystem. The vulnerability stems from insufficient validation of user‑supplied file paths in the /public/plugins/ endpoint.
Exploitability — Public proof‑of‑concept code exists; exploitation requires only a crafted HTTP request. The CVSS v3.1 base score is 7.5 (High).
Affected Products – Grafana (self‑hosted and on‑premises deployments) versions 8.0.0 through 8.5.1.
Why It Matters for Trust & Control Assurance
- Control Objective – Secure Configuration & File Access Controls – The flaw shows that file‑system permissions and input validation were not continuously verified, a gap that undermines evidence of a defensible security posture.
- Continuous Monitoring – Detecting such misconfigurations requires ongoing evidence collection (e.g., automated scans, configuration baselines) to demonstrate due diligence during audits.
- Audit Trail – Remediation and proof of patch deployment become part of the audit trail that regulators and enterprise buyers request when evaluating monitoring solutions.
Recommended Actions
- Upgrade Grafana to 8.5.2 or later, where the path‑traversal issue is patched.
- Review and harden file‑system permissions on the Grafana host; restrict the web server’s read access to only required directories.
- Run a post‑patch configuration audit and map the findings to your control‑objective framework (e.g., “file access restrictions”).
- Integrate automated configuration‑drift detection to surface future deviations.
Source: CISA KEV – CVE‑2021‑43798