Description
A user who can create Git Sync provisioning jobs (the Editor role by default) could delete or move files outside the configured repository path with a job that references a resource whose source path contains ../ sequences (path traversal). With a local filesystem repository on versions before 13.0.4 and 13.1.1, this reached files on the Grafana host.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Grafana | Grafana OSS | 13.0.0 – ≤ 13.0.12, 13.1.0 – ≤ 13.1.9, 13.2.0 – ≤ 13.2.5, 13.3.0 – ≤ 13.3.0 | — |
| Grafana | Grafana Enterprise | 13.0.0 – ≤ 13.0.12, 13.1.0 – ≤ 13.1.9, 13.2.0 – ≤ 13.2.5, 13.3.0 – ≤ 13.3.0 | — |
References
- https://grafana.com/security/security-advisories/cve-2026-110992 vendor-advisory