A critical vulnerability in Grafana OSS and Enterprise allows unauthenticated attackers to achieve remote code execution by leveraging unsafe symbolic link resolution during plugin installation.

This is an improper neutralization of special elements used in a path (CWE-22) and improper link resolution (CWE-59) flaw, enabling arbitrary code execution (CWE-94). The vulnerability exists because plugin archives are extracted without adequate validation, allowing the creation of files outside the intended directory with the privileges of the Grafana process.

Successful exploitation allows an attacker to gain full control over the Grafana server process. Given the high CVSS score of 8.8, this poses a severe risk of data exfiltration, lateral movement within the network, and complete compromise of the underlying monitoring infrastructure.

Immediate Action: Review the official Grafana security advisory for the specific patch release corresponding to your installation and apply the update immediately.

Proactive Monitoring: Monitor server logs for suspicious plugin installation activity or unexpected file write events outside of standard plugin directories.

Compensating Controls: Restrict the ability to install plugins from external or untrusted sources and ensure that the Grafana process runs with the least privilege necessary to limit the impact of potential code execution.

Public Exploit Available: No (exploit_available: false)

Due to the potential for remote code execution, this vulnerability represents a significant security risk to all environments running the affected Grafana versions. Administrators should prioritize the identification of all vulnerable instances and apply the vendor-provided patches as soon as they are made available to prevent unauthorized system access.