How severe is CVE-2021-43798?

CVE-2021-43798 has a CVSS score of 7.5/10, rated HIGH. Immediate patching is strongly recommended.

Which packages are affected by CVE-2021-43798?

CVE-2021-43798 affects the following packages: github.com/grafana/grafana (Go), github.com/grafana/grafana (Go), github.com/grafana/grafana (Go), github.com/grafana/grafana (Go). Ecosystems affected: Go.

How do I fix CVE-2021-43798?

Update github.com/grafana/grafana to 8.3.1 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2021-43798 is resolved across your whole dependency graph.

How do I detect CVE-2021-43798 in my Go dependencies?

Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for github.com/grafana/grafana, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

How do I mitigate CVE-2021-43798 if there is no patch (or I can't update yet)?

Resolve every user-supplied path to its canonical form and reject anything that escapes the intended directory, and run the component under an account that has no read or write access outside the directory it legitimately serves.

Is CVE-2021-43798 actively exploited in the wild?

No public exploit code has been indexed for CVE-2021-43798 yet. This does not mean the vulnerability cannot be exploited — absence of public exploits does not imply safety. Apply the recommended fix and use O3 Security to monitor your exposure.

What is the EPSS score for CVE-2021-43798?

CVE-2021-43798 has an EPSS (Exploit Prediction Scoring System) score of 88.5%, placing it in the 100th percentile of all CVEs. EPSS is maintained by FIRST.org and estimates the probability that a vulnerability will be exploited in the wild within the next 30 days. A score above 50% indicates significantly elevated exploitation risk — immediate patching is strongly recommended.

Is CVE-2021-43798 in the CISA Known Exploited Vulnerabilities catalog?

Yes. CVE-2021-43798 (Grafana Path Traversal Vulnerability) was added to CISA's Known Exploited Vulnerabilities (KEV) catalog on 2025-10-09. CISA required all US federal civilian agencies to remediate this vulnerability by 2025-10-30. The required action was: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Being listed in the KEV catalog is the strongest possible confirmation of active exploitation — treat this as a critical priority.

What type of vulnerability is CVE-2021-43798?

CVE-2021-43798 is classified as Path Traversal (CWE-22). This weakness type describe the underlying flaw category, which helps determine the potential impact and the right class of mitigation. This is a high-impact weakness class that often enables remote code execution or data exposure.

Is there exploit tooling available for CVE-2021-43798?

A Nuclei detection template exists for CVE-2021-43798, meaning automated scanners can fingerprint it. Public exploit tooling significantly increases real-world risk — prioritize patching and ensure detection coverage. Exploit tooling should only ever be used in isolated, authorized testing environments.

When was CVE-2021-43798 published, and has it been updated?

CVE-2021-43798 was published on December 7, 2021 and was last updated on October 20, 2026. Advisory data evolves as severity scores, affected ranges, and exploit intelligence are revised — always check the latest version of the advisory before acting.

🐹

🐹 Go

CISA KEV · ACTIVELY EXPLOITED

HIGH severity

CVE-2021-43798 — grafana

HIGHFix: grafana/grafana@c798c0e

CVE-2021-43798 is a high-severity (CVSS 7.5) Path Traversal vulnerability in github.com/grafana/grafana. It is in CISA's Known Exploited Vulnerabilities catalog (added 2025-10-09) — treat it as actively exploited and patch now. A fix is available for github.com/grafana/grafana — see the affected versions and patch details below.

Grafana path traversal

Also known asBIT-grafana-2021-43798GHSA-8pjx-jj86-j47p

Published

Dec 7, 2021

Updated

Oct 20, 2026

Affected

4 pkgs

Patched

4 / 4

Exploits

None indexed

Exploitation data as of Oct 24, 2026 · OSV.dev, NVD, CISA KEV, FIRST.org (EPSS)

Exploitation Status

Actively exploited in the wild

Confirmed by CISA's Known Exploited Vulnerabilities catalog on 2025-10-09. Federal agencies were required to remediate by 2025-10-30.
CISA assesses this as automatable — exploitation doesn’t require manual, per-target effort, which raises the odds of mass scanning and opportunistic attacks.

Exploitation and automatability from CISA (KEV catalog and SSVC triage) for CVE-2021-43798.

EPSS Exploitation Probability

via FIRST.org ↗

88.5%probability of exploitation in next 30 days

Very High Risk0.00%

Lower risk than most CVEs100th percentile — riskier than 100% of all scored CVEsHighest risk

Probability of exploitation in the next 30 days, from FIRST.org EPSS.

How urgent is this, really

CVE-2021-43798 by exploitation likelihood (EPSS) against impact (CVSS). In the shaded patch-first corner (EPSS 50%+, CVSS 7.0+).

Where this sits among everything scored

Of 395,249 CVEs with a current EPSS score, this one falls in the 50–90% band (highlighted). Counts from FIRST.org, log-scaled.

Real-World Exposure

4 pkgs affected

🐹github.com/grafana/grafana🐹github.com/grafana/grafana🐹github.com/grafana/grafana🐹github.com/grafana/grafana

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects Go packages — download data is not available via public APIs for these ecosystems.

Description

Today we are releasing Grafana 8.3.1, 8.2.7, 8.1.8, 8.0.7. This patch release includes a high severity security fix that affects Grafana versions from v8.0.0-beta1 through v8.3.0.

Release v8.3.1, only containing a security fix:

Release v8.2.7, only containing a security fix:

Release v8.1.8, only containing a security fix:

Release v8.0.7, only containing a security fix:

Path Traversal (CVE-2021-43798)

Summary

On 2021-12-03, we received a report that Grafana is vulnerable to directory traversal, allowing access to local files. We have confirmed this for versions 8.0.0-beta1 to 8.3.0. Thanks to our defense-in-depth approach, at no time has Grafana Cloud been vulnerable.

The vulnerable URL path is: <grafana_host_url>/public/plugins/<plugin-id>/, where <plugin-id> is the plugin ID for any installed plugin.

Every Grafana instance comes with pre-installed plugins like the Prometheus plugin or MySQL plugin so the following URLs are vulnerable for every instance:

<grafana_host_url>/public/plugins/alertlist/
<grafana_host_url>/public/plugins/annolist/
<grafana_host_url>/public/plugins/barchart/
<grafana_host_url>/public/plugins/bargauge/
<grafana_host_url>/public/plugins/candlestick/
<grafana_host_url>/public/plugins/cloudwatch/
<grafana_host_url>/public/plugins/dashlist/
<grafana_host_url>/public/plugins/elasticsearch/
<grafana_host_url>/public/plugins/gauge/
<grafana_host_url>/public/plugins/geomap/
<grafana_host_url>/public/plugins/gettingstarted/
<grafana_host_url>/public/plugins/grafana-azure-monitor-datasource/
<grafana_host_url>/public/plugins/graph/
<grafana_host_url>/public/plugins/heatmap/
<grafana_host_url>/public/plugins/histogram/
<grafana_host_url>/public/plugins/influxdb/
<grafana_host_url>/public/plugins/jaeger/
<grafana_host_url>/public/plugins/logs/
<grafana_host_url>/public/plugins/loki/
<grafana_host_url>/public/plugins/mssql/
<grafana_host_url>/public/plugins/mysql/
<grafana_host_url>/public/plugins/news/
<grafana_host_url>/public/plugins/nodeGraph/
<grafana_host_url>/public/plugins/opentsdb
<grafana_host_url>/public/plugins/piechart/
<grafana_host_url>/public/plugins/pluginlist/
<grafana_host_url>/public/plugins/postgres/
<grafana_host_url>/public/plugins/prometheus/
<grafana_host_url>/public/plugins/stackdriver/
<grafana_host_url>/public/plugins/stat/
<grafana_host_url>/public/plugins/state-timeline/
<grafana_host_url>/public/plugins/status-history/
<grafana_host_url>/public/plugins/table/
<grafana_host_url>/public/plugins/table-old/
<grafana_host_url>/public/plugins/tempo/
<grafana_host_url>/public/plugins/testdata/
<grafana_host_url>/public/plugins/text/
<grafana_host_url>/public/plugins/timeseries/
<grafana_host_url>/public/plugins/welcome/
<grafana_host_url>/public/plugins/zipkin/

We have received CVE-2021-43798 for this issue. The CVSS score for this vulnerability is 7.5 High (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) for Grafana versions 8.0.0-beta1 to 8.3.0

Affected versions with high severity

Grafana 8.0.0-beta1 to 8.3.0

Solutions and mitigations

All installations between v8.0.0-beta1 and v8.3.0 should be upgraded as soon as possible.

If you can not upgrade, running a reverse proxy in front of Grafana that normalizes the PATH of the request will mitigate the vulnerability. For example the normalize_path setting in envoy.

Thanks to our defense-in-depth approach, Grafana Cloud instances have not been affected by the vulnerability.

As always, we closely coordinated with all cloud providers licensed to offer Grafana Pro. They have received early notification under embargo and confirmed that their offerings are secure at the time of this announcement. In alphabetical order, this is applicable to Amazon Managed Grafana, and Azure Managed Grafana.

Timeline and postmortem

Here is a detailed timeline starting from when we originally learned of the issue. All times in UTC.

2021-12-03: Security researcher sends the initial report
2021-12-03: Confirmed for 8.0.0-beta1 through 8.3.0
2021-12-03: Confirmed that Grafana Cloud is not vulnerable
2021-12-03: Security fix determined and committed to Git
2021-12-03: Release timeline determined: 2021-12-07 for private customer release, 2021-12-14 for public release
2021-12-06: Second report about the vulnerability received
2021-12-07: We received information that the vulnerability has been leaked to the public, turning it into a 0 day
2021-12-07: Decision made to release as quickly as feasible
2021-12-07: Private release with reduced two hour grace period instead of the usual 1 week
2021-12-07: Public release

Acknowledgements

We would like to thank Jordy Versmissen for finding the vulnerability and alerting us to it.

Reporting security Issues

If you think you have found a security vulnerability, please send a report to [email protected]. This address can be used for all of Grafana Labs' open source and commercial products (including but not limited to Grafana, Grafana Cloud, Grafana Enterprise, and grafana.com). We can accept only vulnerability reports at this address. We would prefer that you encrypt your message to us by using our PGP key. The key fingerprint is

F988 7BEA 027A 049F AE8E 5CAA D125 8932 BE24 C5CA

The key is available from keyserver.ubuntu.com.

Security announcements

We maintain a security category on our blog, where we will always post a summary, remediation, and mitigation details for any patch containing security fixes.

You can also subscribe to our RSS feed.

Affected Packages

4 total 4 fixed

Ecosystem	Package	Vulnerable range	Fix
🐹Go	`github.com/grafana/grafana`	≥ 8.3.0&&< 8.3.1	8.3.1`go get github.com/grafana/grafana@v8.3.1`
🐹Go	`github.com/grafana/grafana`	≥ 8.2.0&&< 8.2.7	8.2.7`go get github.com/grafana/grafana@v8.2.7`
🐹Go	`github.com/grafana/grafana`	≥ 8.1.0&&< 8.1.8	8.1.8`go get github.com/grafana/grafana@v8.1.8`
🐹Go	`github.com/grafana/grafana`	≥ 8.0.0-beta1&&< 8.0.7	8.0.7`go get github.com/grafana/grafana@v8.0.7`

Affected Products

1 product · 7 configurations

Application

grafanagrafana

≥ 8.2.0 && < 8.2.7

2 versions

8.0.08.3.0

Detection & mitigation playbook

Open-source dependency

Detect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for github.com/grafana/grafana, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update github.com/grafana/grafana to 8.3.1 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2021-43798 is resolved across your whole dependency graph.
Workarounds
Resolve every user-supplied path to its canonical form and reject anything that escapes the intended directory, and run the component under an account that has no read or write access outside the directory it legitimately serves.

How to detect CVE-2021-43798

A community-maintained Nuclei template exists for this CVE. You can scan for it directly:

nuclei -id cve-2021-43798 -u https://target

Template: Grafana v8.x - Arbitrary File Read
Severity: high
Impact: An attacker can read sensitive files on the server, potentially leading to unauthorized access, data leakage, or further exploitation.
Remediation: Upgrade to patched versions 8.0.7, 8.1.8, 8.2.7, or 8.3.1.

Template by ProjectDiscovery nuclei-templates (z0ne, dhiyaneshDk, j4vaovo), MIT licensed. View the full template. Scan only systems you are authorised to test.

Frequently Asked Questions

Today we are releasing Grafana 8.3.1, 8.2.7, 8.1.8, 8.0.7. This patch release includes a high severity security fix that affects Grafana versions from v8.0.0-beta1 through v8.3.0. Release v8.3.1, only containing a security fix: - [Download Grafana 8.3.1](https://grafana.com/grafana/download/8.3.1) - [Release notes](https://grafana.com/docs/grafana/latest/release-notes/release-notes-8-3-1/) Release v8.2.7, only containing a security fix: - [Download Grafana 8.2.7](https://grafana.com/grafana/download/8.2.7) - [Release notes](https://grafana.com/docs/grafana/latest/release-notes/release-note

O3 Security · Impact-Aware SCA

Is CVE-2021-43798 in your dependencies?

Find it across Go, including transitive dependencies.

Scan my dependencies How O3 SCA works

CVSS Score

7.5/10CVSS v3 base

Vector breakdown

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Raw vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CWE Classification

Weaponization

OpenSSF Scorecard

Package health score

grafana

6.8/10

Code-Review10/10

Maintained10/10

Branch-Protection5/10

Assessed Oct 19, 2026

Timeline

Disclosed

Dec 7, 2021

KEV added

Oct 9, 2025

Last updated

Oct 20, 2026

Identifiers

CVE-2021-43798

GHSA-8pjx-jj86-j47p

BIT-grafana-2021-43798

References

Advisorypacketstormsecurity.com Advisorygrafana.com Advisorysecurity.netapp.com Advisorynvd.nist.gov Fixopenwall.com Fixopenwall.com Fixgithub.com Fixgithub.com Webcisa.gov Webgrafana.com Websecurity.netapp.com Packagegithub.com Evidencepacketstormsecurity.com

Related vulnerabilities

This CVE is high severity; 3 of 8 other CVEs affecting grafana are rated as high or higher (top: high).

CVE-2026-42127CVE-2026-10601CVE-2026-9029CVE-2026-42129CVE-2026-33380CVE-2026-33381CVE-2026-21727CVE-2026-27877

Provenance

Sources

OSV.devNVDCISA KEVFIRST.org (EPSS)

Last verifiedOct 20, 2026

CVE-2021-43798 — grafana

Exploitation Status

Actively exploited in the wild

EPSS Exploitation Probability

How urgent is this, really

Where this sits among everything scored

Real-World Exposure

Description

Path Traversal (CVE-2021-43798)

Summary

Affected versions with high severity

Solutions and mitigations

Timeline and postmortem

Acknowledgements

Reporting security Issues

Security announcements

Affected Packages

Affected Products

Detection & mitigation playbook

Detect

Fix

Workarounds

How to detect CVE-2021-43798

Frequently Asked Questions

Is CVE-2021-43798 in your dependencies?