GHSA-gxcp-jjxh-rwp4
Grafana: SQL Expressions Read File From Disk
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Go | github.com/grafana/grafana | < 1.9.2-0.20260513165311-fb7336fc36c1 | 1.9.2-0.20260513165311-fb7336fc36c1 |
Details
As written in the advisory (Markdown source, shown as plain text).
A vulnerability in SQL Expressions allows an authenticated attacker to read arbitrary files from the Grafana server's filesystem. Only instances with the sqlExpressions feature toggle enabled are vulnerable.
References
External links from the advisory. They lead to third-party sites.