CVE-2021-43798: Grafana Plugin Path Traversal (KEV, re-added 2025)

CVE-2021-43798 is an unauthenticated directory-traversal flaw in Grafana's plugin static-file handler (`/public/plugins/<plugin id>/../../../../etc/passwd`-style paths) that lets a remote attacker read arbitrary files on the host filesystem — not direct code execution, but enough to pull out provisioning files, data source credentials and other secrets — and CISA only added it to the KEV catalog in October 2025, nearly four years after disclosure, indicating renewed in-the-wild interest in unpatched installs.

CVE-2021-43798 is a path traversal vulnerability (CWE-22) in Grafana, the open-source observability platform. NVD's description states: "Grafana is an open-source platform for monitoring and observability. Grafana versions 8.0.0-beta1 through 8.3.0 (except for patched versions) [are] vulnerable to directory traversal, allowing access to local files. The vulnerable URL path is: <grafana_host_url>/public/plugins/<plugin id>/... At no time has Grafana Cloud been vulnerable" (NVD).

This is an older CVE where NVD's only Primary-labeled metric is still on the legacy CVSS v2.0 scale: score 5.0, submitted by NVD itself. A GitHub Security Advisory Secondary submission scores it higher under the modern CVSS v3.1 standard — 7.5 (high), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N — reflecting that unauthenticated, network-exploitable file disclosure is treated more severely under v3.1's scoring model. This page reports NVD's own Primary (v2.0) figure rather than presenting the higher GitHub number as NVD-confirmed, while flagging both for context (NVD).

Grafana's own GitHub Security Advisory (GHSA-8pjx-jj86-j47p) and the accompanying blog post confirm the affected range above, state the vulnerability was being exploited before a patch was available (handled as a 0-day), and direct users to upgrade to 8.0.7, 8.1.8, 8.2.7 or 8.3.1 (Grafana GitHub Security Advisory, Grafana blog: update on 0-day CVE-2021-43798).

CISA added CVE-2021-43798 to the Known Exploited Vulnerabilities catalog on 2025-10-09, with a required-action due date of 2025-10-30 — notably almost four years after the CVE's original December 2021 disclosure, which typically signals newly observed scanning or exploitation activity against the long tail of unpatched installs rather than a new technical finding (CISA KEV).

As of 2026-10-29, FIRST scores the probability of exploitation at 0.8850 (99.771th percentile) — very high, consistent with a well-understood, easily automated traversal bug against a widely deployed self-hosted monitoring platform (FIRST EPSS).

Any self-hosted Grafana instance still running 8.0.0-beta1 through 8.3.0 (unpatched) should be upgraded immediately; given the age of this disclosure, any such instance exposed to the internet should also be treated as a candidate for prior compromise and checked for unauthorized access to data source configuration and secrets.

• Grafana 8.0.0-beta1 through 8.3.0 (except patched point releases) is vulnerable to directory traversal via /public/plugins/<plugin id>/ paths, allowing access to arbitrary local files; Grafana Cloud was never affected. — NVD
• NVD's Primary metric is CVSS v2.0, score 5.0 ([email protected]); GitHub Security Advisories submitted a Secondary CVSS v3.1 score of 7.5 (high), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. — NVD
• Confirms the affected version range, that exploitation occurred before a patch existed, and that users should upgrade to 8.0.7, 8.1.8, 8.2.7 or 8.3.1. — Grafana GitHub Security Advisory GHSA-8pjx-jj86-j47p
• Added to the CISA Known Exploited Vulnerabilities catalog on 2025-10-09, required-action due date 2025-10-30, roughly four years after original disclosure. — CISA KEV
• EPSS score is 0.8850 (99.771th percentile) as of 2026-10-29. — FIRST EPSS