CVE-2021-43798
CVSS v3
7.5
HIGH
EPSS Score
94.4 %
exploit probability
CISA KEV
Yes
known exploited
Exploitation
—
SSVC status
Description
Grafana is an open-source platform for monitoring and observability. Grafana versions 8.0.0-beta1 through 8.3.0 (except for patched versions) iss vulnerable to directory traversal, allowing access to local files. The vulnerable URL path is: `<grafana_host_url>/public/plugins//`, where is the plugin ID for any installed plugin. At no time has Grafana Cloud been vulnerable. Users are advised to upgrade to patched versions 8.0.7, 8.1.8, 8.2.7, or 8.3.1. The GitHub Security Advisory contains more information about vulnerable URL paths, mitigation, and the disclosure timeline.
CISA Known Exploited Vulnerability
- Date Added
- 2025-10-09
- Patch Due Date
- 2025-10-30
- Ransomware Use
- Unknown
Technical details
- Published
- 2021-12-07
- Exploit-DB
- EDB-50581
Frequently asked questions
What is CVE-2021-43798?
Grafana is an open-source platform for monitoring and observability. Grafana versions 8.0.0-beta1 through 8.3.0 (except for patched versions) iss vulnerable to directory traversal, allowing access to local files. The vulnerable URL path is: `<grafana_host_url>/public/plugins//`, where is the plugin ID for any installed plugin. At no time has Grafana Cloud been vulnerable. Users are advised to upgrade to patched versions 8.0.7, 8.1.8, 8.2.7, or 8.3.1. The GitHub Security Advisory contains more information about vulnerable URL paths, mitigation, and the disclosure timeline.
Is CVE-2021-43798 actively exploited?
Yes. CVE-2021-43798 is on the CISA Known Exploited Vulnerabilities (KEV) catalog, meaning it has been confirmed as actively exploited in the wild. CISA requires federal agencies to patch by 10/30/2025.
What is the CVSS score for CVE-2021-43798?
CVE-2021-43798 has a CVSS v3 base score of 7.5 (HIGH severity).
Is CVE-2021-43798 affecting your environment?
Use isMalicious to check if any of your IPs or domains are associated with this vulnerability's IOCs.
No credit card required · 30 free checks/month · Free API key
Other 2021 vulnerabilities worth triaging
Ranked by exploit probability (EPSS).