Grafana is an open-source platform for monitoring and observability.
CVE-2021-43798 Exploited
Grafana is an open-source platform for monitoring and observability. Grafana versions 8.0.0-beta1 through 8.3.0 (except for patched versions) iss vulnerable to directory traversal, allowing access to local files. The vulnerable URL path is: /public/plugins//, where is the plugin ID for any installed plugin. At no time has Grafana Cloud been vulnerable. Users are advised to upgrade to patched versions 8.0.7, 8.1.8, 8.2.7, or 8.3.1. The GitHub Security Advisory contains more information about vulnerable URL paths, mitigation, and the disclosure timeline.
Being exploited in the wild
Catalogued 9 October 2025 · US federal remediation deadline 30 October 2025
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Exploit code is also public: Metasploit · Exploit-DB · Public PoC · Nuclei template
- Metasploitauxiliary/scanner/http/grafana_plugin_traversal
- Exploit-DBGrafana 8.3.0 - Directory Traversal and Arbitrary File Read
- NucleiGrafana v8.x - Arbitrary File Read
- Public PoCjas502n/Grafana-CVE-2021-43798370 stars
- Public PoCA-D-Team/grafanaExp270 stars
- Public PoCpedrohavay/exploit-grafana-CVE-2021-4379846 stars
- Public PoCtaythebot/CVE-2021-4379843 stars
- Public PoCzer0yu/CVE-2021-4379827 stars
- Public PoCMr-xn/CVE-2021-4379824 stars
- Public PoCMoCh3n/CVE-2021-43798-grafana_fileread17 stars
- Public PoCScorpionsMAX/CVE-2021-43798-Grafana-POC14 stars
Assessment
- CVSS
- 7.5 (v3.1)
- Severity
- High
- EPSS
- 88.5% chance of exploitation in the next 30 days
- Known exploited
- Yes — listed in the CISA KEV catalog
- Exploit availability
- CISA KEV, Metasploit, Exploit-DB, Public PoC, Nuclei template
- Published
- 7 December 2021
- Last updated
- 17 June 2026
- Affected
- Grafana · Grafana Labs · Grafana
- Weakness
- CWE-22
- Assigner
- security-advisories@github.com
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
At the source
References
- http://packetstormsecurity.com/files/165198/Grafana-Arbitrary-File-Reading.html
- http://packetstormsecurity.com/files/165221/Grafana-8.3.0-Directory-Traversal-Arbitrary-File-Read.html
- http://www.openwall.com/lists/oss-security/2021/12/09/2
- http://www.openwall.com/lists/oss-security/2021/12/10/4
- https://github.com/grafana/grafana/commit/c798c0e958d15d9cc7f27c72113d572fa58545ce
- https://github.com/grafana/grafana/security/advisories/GHSA-8pjx-jj86-j47p
- https://grafana.com/blog/2021/12/08/an-update-on-0day-cve-2021-43798-grafana-directory-traversal/
- https://security.netapp.com/advisory/ntap-20211229-0004/
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog
Community proofs of concept
No community proof of concept yet. If you have one for a published vulnerability and the right to share it, add it below — it will appear here once reviewed.
Submit a proof of concept
Only for publicly disclosed vulnerabilities, and only material from testing you were authorised to perform. This platform does not buy, sell, or broker exploits — see earning from vulnerability research for legitimate bounty programs. Submissions are reviewed before they appear. Text only; do not include live credentials, personal data, or anything targeting systems you are not permitted to test.
Query this programmatically
Agents can read this through the MCP endpoint, or over HTTP:
curl https://cve.zerocrew.in/api/cve/CVE-2021-43798