UpHeron
All vulnerabilities

Servers and applications

CVE-2021-43813

CVE-2021-43813: Grafana directory traversal for `.md` files, 5.0.0 - 8.3.1

Severity
Medium 4.3
Published
10 Dec 2021
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
7.5.12, 8.3.2
Also known as
GHSA-c3q8-26ph-9g2q
Sources
NVD, Project advisories (GitHub)

Description

Grafana is an open-source platform for monitoring and observability. Grafana prior to versions 8.3.2 and 7.5.12 contains a directory traversal vulnerability for fully lowercase or fully uppercase .md files. The vulnerability is limited in scope, and only allows access to files with the extension .md to authenticated users only. Grafana Cloud instances have not been affected by the vulnerability.…

Affected software

SoftwareAffected versions
GrafanaServers and applications · cpe:a:grafana:grafana
  • From 5.0.0 before 7.5.12
  • From 8.0.0 before 8.3.2
GrafanaServers and applications · github:grafana/grafana
  • From 5.0.0 before 7.5.12

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2021-43813
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2021-43813
  • GitHub Advisory Database https://github.com/advisories/GHSA-c3q8-26ph-9g2q
  • github.com https://github.com/grafana/grafana/security/advisories/GHSA-c3q8-26ph-9g2q