CVE-2021-43815Grafana directory traversal for `.cvs` files
- 4.3MediumCVSS base score
- 1.9%Exploitation in 30 daysEPSS · top 20% of all CVEs
- NoKnown exploitednot in CISA's KEV catalog
- NonePublic exploitsnone known yet
Description
Grafana is an open-source platform for monitoring and observability. Grafana prior to versions 8.3.2 and 7.5.12 has a directory traversal for arbitrary .csv files. It only affects instances that have the developer testing tool called TestData DB data source enabled and configured. The vulnerability is limited in scope, and only allows access to files with the extension .csv to authenticated users only. Grafana Cloud instances have not been affected by the vulnerability. Versions 8.3.2 and 7.5.12 contain a patch for this issue. There is a workaround available for users who cannot upgrade. Running a reverse proxy in front of Grafana that normalizes the PATH of the request will mitigate the vulnerability. The proxy will have to also be able to handle url encoded paths.
Timeline
ID reserved
By GitHub_M
- 24 days later
· 24 days later
Published
- 3 years later
· 3 years later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| GitHub_MCNA (assigner) | 3.1 | Medium4.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N |
| NVDNVD · Modified | 3.1 | Medium4.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N |
- EPSS (exploitation in 30 days)
- 1.9% · top 20% of all CVEs (13 Nov 2026)
The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 4.3.
Affected products
Affected packages
From reviewed advisories of the GitHub Advisory Database.
- Gogithub.com/grafana/grafanaGHSA-7533-c8qv-jm9m (opens in a new tab)
References
References7
- https://github.com/grafana/grafana/commit/fd48aee61e4328aae8d5303a9efd045fa0ca308d (opens in a new tab)x_refsource_MISCx_transferred
- https://grafana.com/blog/2021/12/10/grafana-8.3.2-and-7.5.12-released-with-moderate-severity-security-fix/ (opens in a new tab)x_refsource_MISCx_transferred
- https://github.com/grafana/grafana/security/advisories/GHSA-7533-c8qv-jm9m (opens in a new tab)x_refsource_CONFIRMx_transferred
- https://github.com/grafana/grafana/commit/d6ec6f8ad28f0212e584406730f939105ff6c6d3 (opens in a new tab)x_refsource_MISCx_transferred
- https://github.com/grafana/grafana/releases/tag/v8.3.2 (opens in a new tab)x_refsource_MISCx_transferred
- [oss-security] 20211210 CVE-2021-43813 and CVE-2021-43815 - Grafana directory traversal for some .md and .csv files (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
- https://security.netapp.com/advisory/ntap-20220107-0006/ (opens in a new tab)x_refsource_CONFIRMx_transferred
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- EUVD EUVD-2024-1473 (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisory GHSA-7533-c8qv-jm9m (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2021-43815)Record last updated .