medium6.3
CVE-2026-33380
A vulnerability in SQL Expressions allows an authenticated attacker to read arbitrary files from the Grafana server's filesystem.
Impact
A vulnerability in SQL Expressions allows an authenticated attacker to read arbitrary files from the Grafana server's filesystem. Only instances with the sqlExpressions feature toggle enabled are vulnerable.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| go | github.com/grafana/grafana | < 1.9.2-0.20260513165311-fb7336fc36c1 | 1.9.2-0.20260513165311-fb7336fc36c1 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Grafana | Grafana | from 11.6.0 before 11.6.14 from 12.2.0 before 12.2.8 from 12.3.0 before 12.3.6 from 12.4.0 before 12.4.3 from 13.0.0 before 13.0.1 |