Path Traversal Vulnerability in Grafana Affecting User Roles
CVE-2026-110992

6.5MEDIUM

Key Information:

Vendor

Grafana
Status
Grafana Oss
Grafana Enterprise
Vendor
CVE Published:
11 November 2026

What is CVE-2026-110992?

An issue allows users with the ability to create Git Sync provisioning jobs to exploit path traversal vulnerabilities. By referencing resources with source paths containing ../ sequences, these users could manipulate file structures, leading to potential unauthorized deletion or relocation of files outside the intended repository path. This specifically affects local filesystem repositories on certain Grafana versions, posing risks to file integrity on the Grafana host.

Affected Version(s)

Grafana Enterprise 13.0.0 <= 13.0.12

Grafana Enterprise 13.1.0 <= 13.1.9

Grafana Enterprise 13.2.0 <= 13.2.5

References

https://grafana.com/security/security-advisories/cve-2026...
vendor-advisory

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

velvelvel
.