CVE-2021-43798
CWE-22
89.9
RPSRPS range: 0–105; KEV-listed vulnerabilities can receive an exploitation amplifier.
Description
Grafana is an open-source platform for monitoring and observability. Grafana versions 8.0.0-beta1 through 8.3.0 (except for patched versions) iss vulnerable to directory traversal, allowing access to local files. The vulnerable URL path is: `<grafana_host_url>/public/plugins//`, where is the plugin ID for any installed plugin. At no time has Grafana Cloud been vulnerable. Users are advised to upgrade to patched versions 8.0.7, 8.1.8, 8.2.7, or 8.3.1. The GitHub Security Advisory contains more information about vulnerable URL paths, mitigation, and the disclosure timeline.
Source: NVD
Signals
- CVSS
- 7.5
- High · v3.1
- EPSS
- 88.50%
- Probability of exploitation in the next 30 days (FIRST)
- CISA KEV
- In CISA KEV since Oct 2025
- Fix commit
- Fix commit known
- Sources: MoreFixes, FreshFixes
- Weakness
- CWE-22
- Published
- 7 Dec 2021
- Last modified 24 Oct 2025
How to read these signals: RPS · EPSS · CISA KEV · Data sources
Get this score from the API
curl -H "Authorization: Bearer dsec_live_xxxxxxxx" \
https://api.intelligence.devsecure.io/api/v1/rps/CVE-2021-43798Replace the placeholder with your key. Get a free API key or rank your own CVEs.
Data as of 7 Oct 2026, 05:16 UK time