Vulnerability record · CVE-2021-43813 · published 10 December 2021
CVE-2021-43813: Grafana directory traversal in markdown plugin endpoint
Grafana · Grafana
Grafana before 8.3.2 and 7.5.12 contains a directory traversal flaw reachable through the plugin markdown endpoint, but only for files whose extension is fully lowercase or fully uppercase .md. The scope is narrow and access requires an authenticated user, so the practical exposure is limited to reading markdown files rather than arbitrary files.
Description
Grafana is an open-source platform for monitoring and observability. Grafana prior to versions 8.3.2 and 7.5.12 contains a directory traversal vulnerability for fully lowercase or fully uppercase .md files. The vulnerability is limited in scope, and only allows access to files with the extension .md to authenticated users only. Grafana Cloud instances have not been affected by the vulnerability. Users should upgrade to patched versions 8.3.2 or 7.5.12. For users who cannot upgrade, running a reverse proxy in front of Grafana that normalizes the PATH of the request will mitigate the vulnerability. The proxy will have to also be able to handle url encoded paths. Alternatively, for fully lowercase or fully uppercase .md files, users can block /api/plugins/.*/markdown/.* without losing any functionality beyond inlined plugin help text.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Automated analysis
medium priorityThe flaw is authenticated, limited to .md file disclosure, and has an official patch, though its high EPSS score warrants prompt remediation.
What it is
Grafana before 8.3.2 and 7.5.12 contains a directory traversal flaw reachable through the plugin markdown endpoint, but only for files whose extension is fully lowercase or fully uppercase .md. The scope is narrow and access requires an authenticated user, so the practical exposure is limited to reading markdown files rather than arbitrary files.
Impact
An authenticated attacker can read .md files outside the intended plugin markdown directory, gaining limited information disclosure. No integrity or availability impact is described.
Attack surface
Reached over the network via the Grafana HTTP API path /api/plugins/.*/markdown/.*, requiring a valid authenticated session and no user interaction. Grafana Cloud instances are stated as unaffected.
Exploitation
Not listed in CISA KEV and no ransomware usage is documented; EPSS is high at roughly 0.575 (99th percentile), and references are patch, release note and advisory material with no public exploit tag.
What to do
- Upgrade Grafana to 8.3.2 or 7.5.12 or later.
- If upgrade is not possible, place a reverse proxy in front of Grafana that normalizes request paths and handles URL-encoded paths.
- Block requests matching /api/plugins/.*/markdown/.* at the proxy, accepting loss of inlined plugin help text.
- Restrict Grafana authentication to trusted users and review accounts with access to the plugin markdown endpoint.
Detection
- Monitor Grafana and proxy logs for requests to /api/plugins/*/markdown/* containing traversal sequences such as ../ or encoded variants.
- Alert on markdown endpoint requests that resolve outside the expected plugin directory or return .md files from unexpected paths.
- Baseline normal markdown endpoint usage per user and flag anomalous or high-volume access.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2021-43813 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2021-43813), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
