UpHeron
All vulnerabilities

Servers and applications

CVE-2026-110992

Path traversal in Git Sync delete and move jobs

Severity
Medium 6.5
Published
11 Nov 2026
Last changed
11 Nov 2026
Added to UpHeron
11 Nov 2026
Weakness
Path traversal (CWE-22)CWE-73
Attack
Over the network · Needs a user account · No user action needed
Attacker can
Change data
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Sources
CVE Program

Description

A user who can create Git Sync provisioning jobs (the Editor role by default) could delete or move files outside the configured repository path with a job that references a resource whose source path contains ../ sequences (path traversal). With a local filesystem repository on versions before 13.0.4 and 13.1.1, this reached files on the Grafana host.

From the CVE Program.

Affected software

SoftwareAffected versions
GrafanaServers and applications · cna:grafana|grafana enterprise
  • From 13.0.0 up to 13.0.12
  • From 13.1.0 up to 13.1.9
  • From 13.2.0 up to 13.2.5
  • From 13.3.0 up to 13.3.0

References

  • CVE.org https://www.cve.org/CVERecord?id=CVE-2026-110992