Summary
[9.2.10-35.0.1]
- Fixes CVE-2024-1442 Add email verification when updating user email [Orabug: 38550520]
[9.2.10-35]
- CVE-2026-15815 grafana: PLUGIN ARCHIVE EXTRACTION ESCAPES THE PLUGIN DIRECTORY, ALLOWING CODE EXECUTION
- Resolves RHEL-253157
[9.2.10-34]
- CVE-2026-42504 grafana: Golang MIME: Denial of Service via maliciously-crafted MIME header [rhel-9.8.z]
- Resolves RHEL-266517
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 8 | grafana | 0:9.2.10-35.0.1.el8_10 |
| Oracle Linux · 8 | grafana-selinux | 0:9.2.10-35.0.1.el8_10 |
Vulnerabilities 1
-
High 8.8
CVE-2026-15815 CVE Record
Grafana OSS and Grafana Enterprise did not safely resolve symbolic links when extracting plugin archives. A crafted plugin archive can chain relative symbolic link entries to escape the plugin installation directory, writing arbitrary files and an executable …