# CVE-2026-110992: Grafana path traversal in Git Sync provisioning

Source: https://junglewise.ai/threats/cve-2026-110992-a-user-who-can-create-git-sync-provisioning-jobs-the-editor-role  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-11. Updated: 2026-11-11  
License: CC BY 4.0 with a link back

CVE-2026-110992 · Severity: medium · CVSS 6.5 · Published 2026-11-11

Grafana's Git Sync feature allows users with the Editor role to provision configurations from a Git repository. An attacker with this role can exploit path traversal sequences in resource paths to delete or move files outside the intended repository directory, potentially reaching sensitive files on the Grafana host system when using local filesystem repositories.

Technologies: [Grafana](https://junglewise.ai/threats/technologies/grafana-grafana). Vendors: [Grafana](https://junglewise.ai/threats/vendors/grafana).

## Quick answers

**Is CVE-2026-110992 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-110992 being exploited in the wild.

**How severe is CVE-2026-110992?** Medium severity, with a CVSS score of 6.5, published 11 November 2026.

**Which products and versions are affected?** Grafana before 13.0.4 and 13.1.1.

**Is there a fix for CVE-2026-110992?** Yes: fixed in Grafana 13.0.4, 13.1.1. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-110992 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-110992?** Check whether you run Grafana at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in Grafana 13.0.4, 13.1.1

## Technical details

A path traversal vulnerability in Git Sync provisioning allows authenticated users (Editor role or higher) to craft resources with source paths containing ../ sequences, enabling arbitrary file operations outside the configured repository. The vulnerability affects local filesystem repositories on Grafana versions before 13.0.4 and 13.1.1, where the attacker can delete or move files on the host system via provisioning jobs.

## Affected products

- Grafana Grafana before 13.0.4 and 13.1.1

## Timeline

- 2026-11-11: advisory

## References

- [https://grafana.com/security/security-advisories/cve-2026-110992](https://grafana.com/security/security-advisories/cve-2026-110992)

## Related threats

- [Grafana Elasticsearch data source denial of service via time range](https://junglewise.ai/threats/cve-2026-81843-grafana-is-an-open-source-platform-for-monitoring-and)
- [Grafana Elasticsearch data source improper authorization in resource proxy](https://junglewise.ai/threats/cve-2026-106475-the-elasticsearch-data-source-resource-proxy-forwards-the)
- [Grafana Prometheus data source path traversal](https://junglewise.ai/threats/cve-2026-106472-grafana-s-prometheus-data-source-passes-the-resource-path)
- [Grafana authorization bypass in team preferences endpoint](https://junglewise.ai/threats/cve-2026-82014-any-authenticated-user-including-a-viewer-could-change-the)
- [Grafana authorization bypass in Git Sync provisioning API](https://junglewise.ai/threats/cve-2026-13721-a-user-with-edit-access-to-one-folder-could-modify-move-or-delete)