CVE-2026-110992 · Vendor
NO FIX YET · SEE WHAT TO DO
A user who can create Git Sync provisioning jobs, which the Editor role allows by default, can use a resource path containing ../ sequences to delete or move files outside the configured repository. With a local filesystem repository on Grafana versions before 13.0.4 and 13.1.1, this reaches files on the Grafana host.
first public Nov 11, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Grafana instances that use Git Sync with a local filesystem repository are exposed, and only users who can create provisioning jobs can trigger the flaw. Instances on versions 13.0.4 or 13.1.1 and later, or instances that do not use Git Sync with a local filesystem repository, are not affected by the reported impact.
Not affected if fixed-version, no-git-sync, remote-git-repository
Who cares git-sync, grafana, self-hosted
grafana server -v or the About page in the UI.13.0.4 and 13.1.1: move to 13.0.4 or 13.1.1 or later.A user who can create Git Sync provisioning jobs (the Editor role by default) could delete or move files outside the configured repository path with a job that references a resource whose source path contains ../ sequences (path traversal). With a local filesystem repository on versions before 13.0.4 and 13.1.1, this reached files on the Grafana host.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.