Lack of data validation - Path Traversal In grafana
Description
A flaw was found in Grafana. When extracting plugin archives, Grafana did not safely resolve symbolic links. A remote attacker could craft a malicious plugin archive with symbolic links to escape the plugin installation directory. This allows the attacker to write arbitrary files and execute malicious code with the privileges of the Grafana server process, leading to remote code execution.
Mitigation
Update Impact
Minimal update. May introduce new vulnerabilities or breaking changes.
Aliases
1. 2. 3.