Executive brief
Grafana is a widely-used observability platform for monitoring and visualizing infrastructure and application metrics. A vulnerability in its plugin installation system allows an attacker to craft a malicious plugin archive that escapes the plugin directory and writes arbitrary executable files to the server. When a legitimate-looking or untrusted plugin is installed, an attacker can execute code with the full privileges of the Grafana process, compromising the monitoring system and any systems it has access to.
Technical details
The vulnerability is a zip slip (CWE-22, path traversal) in the plugin archive extraction code that fails to safely resolve symbolic links. A crafted archive containing chained relative symbolic link entries can write files outside the intended plugin installation directory. Plugin extraction occurs before signature verification, so even signed plugins with tampered archives can exploit this. The attack is triggered by an operator installing a plugin via the GUI, grafana-cli tool, GF_INSTALL_PLUGINS environment variable, or preinstall configuration. A successful exploit results in arbitrary file write and remote code execution with the Grafana server process privileges. Fixed in versions 12.4.11, 13.0.9, 13.1.6, and 13.2.2.
Affected products
- Grafana Grafana OSS before 12.4.11, 13.0.x before 13.0.9, 13.1.x before 13.1.6, 13.2.x before 13.2.2
- Grafana Grafana Enterprise before 12.4.11, 13.0.x before 13.0.9, 13.1.x before 13.1.6, 13.2.x before 13.2.2
Timeline
- 2026-09-15: disclosed
- 2026-09-15: patched: Fixed versions released: 12.4.11, 13.0.9, 13.1.6, 13.2.2