Background exploitation KEV catalog No authentication

CVE-2021-43798

Grafana Path Traversal Vulnerability

CheckOps priority index

8.1/10 Patch within 24 h

Severity7.5

Probability8.9

Exploitation4/5

Severity = CVSS. Probability = EPSS (FIRST). Exploitation = public signals: KEV, EUVD, ransomware, EPSS above 10 %, no account required.

EPSS · today 88.5% higher than 99.8% of CVEs

CVSS 3.1 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:

Exploited for 390 days 09 Oct 2025

CISA due date 30 Oct 2025 for US federal agencies

Exploitation probability EPSS · FIRST

EPSS probability (%)Percentile among all CVEs

Exploitation signals 4 / 5

KEV catalog (CISA)09 Oct 2025
Exploited in EUVD (ENISA)09 Oct 2025
Used by ransomwareno
EPSS above 10 %88.5%
No account, over the networkyes

What to do

Fix

Update to a fixed version: 8.3.1 8.2.7 8.1.8 8.0.7

CISA guidance: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Meanwhile

Take the service off the internet or restrict access to it, watch the logs and look for signs of compromise.

Manufacturers (CRA)

Exploited vulnerability in your product: early warning to ENISA within 24 h, then notification within 72 h (Article 14 of the Cyber Resilience Act). The CRA explained

Description ENISA EUVD

Grafana is an open-source platform for monitoring and observability. Grafana versions 8.0.0-beta1 through 8.3.0 (except for patched versions) iss vulnerable to directory traversal, allowing access to local files. The vulnerable URL path is: `<grafana_host_url>/public/plugins//`, where is the plugin ID for any installed plugin. At no time has Grafana Cloud been vulnerable. Users are advised to upgrade to patched versions 8.0.7, 8.1.8, 8.2.7, or 8.3.1. The GitHub Security Advisory contains more information about vulnerable URL paths, mitigation, and the disclosure timeline.

Affected products

Grafana

Affected versions

= 8.3.0
8.1.0, < 8.1.8
8.2.0, < 8.2.7
8.0.0, < 8.0.7

Weaknesses (CWE)

CWE-22

Open source packages OSV

github.com/grafana/grafanaGo · GHSA-8pjx-jj86-j47p
fixed in 8.3.1
github.com/grafana/grafanaGo · GHSA-8pjx-jj86-j47p
fixed in 8.2.7
github.com/grafana/grafanaGo · GHSA-8pjx-jj86-j47p
fixed in 8.1.8
github.com/grafana/grafanaGo · GHSA-8pjx-jj86-j47p
fixed in 8.0.7

Timeline

07 Dec 2021
Published
09 Oct 2025
Exploitation reported (ENISA)
09 Oct 2025
Added to the KEV catalog
30 Oct 2025
CISA remediation due date
26 Sept 2026
EPSS peak: 88.5%

References

Other exploited vulnerabilities from the same vendor

CVE-2021-39226Grafana Authentication Bypass Vulnerability
9.3 · Background exploitation