{"id":"EUVD-2026-30145","revision":"a96d72f6339c4882ad8455209f78e25f","records":[{"revision":"a96d72f6339c4882ad8455209f78e25f","observedAt":"2026-10-28T03:59:19.206+00:00","statement":{"source":"euvd","id":"EUVD-2026-30145","aliases":["CVE-2026-33380"],"title":"A vulnerability in SQL Expressions allows an authenticated attacker to read arbitrary files from the Grafana server's filesystem. Only instances with the sqlExpressions feature toggle enabled are vulnerable.","description":"A vulnerability in SQL Expressions allows an authenticated attacker to read arbitrary files from the Grafana server's filesystem. Only instances with the sqlExpressions feature toggle enabled are vulnerable.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N","score":6.3,"severity":null}],"references":["https://grafana.com/security/security-advisories/cve-2026-33380"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-30145","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"May 13, 2026, 7:28:32 PM","dateUpdated":"Aug 27, 2026, 5:22:19 PM"},"relatedAdvisories":[{"id":"SUSE-SU-2026:2774-1","title":"Security update 5.1.4 for Multi-Linux Manager Server","vulnerabilityIds":["CVE-2022-21698","CVE-2026-28374","CVE-2026-28376","CVE-2026-28379","CVE-2026-28380","CVE-2026-28383","CVE-2026-33376","CVE-2026-33377","CVE-2026-33378","CVE-2026-33380","CVE-2026-33381","CVE-2026-34986","CVE-2026-39821","CVE-2026-40179","CVE-2026-41602","CVE-2026-42151","CVE-2026-42154","CVE-2026-42198"]},{"id":"RHSA-2026:68778","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","vulnerabilityIds":["CVE-2026-28374","CVE-2026-28376","CVE-2026-28379","CVE-2026-28380","CVE-2026-28383","CVE-2026-33376","CVE-2026-33377","CVE-2026-33378","CVE-2026-33380","CVE-2026-33381","CVE-2026-42127","CVE-2026-81871","CVE-2026-81872","CVE-2026-92599"]},{"id":"RHSA-2026:68821","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","vulnerabilityIds":["CVE-2026-28374","CVE-2026-28376","CVE-2026-28379","CVE-2026-28380","CVE-2026-28383","CVE-2026-33376","CVE-2026-33377","CVE-2026-33378","CVE-2026-33380","CVE-2026-33381","CVE-2026-61709","CVE-2026-81871","CVE-2026-81872","CVE-2026-92599"]},{"id":"SUSE-SU-2026:3718-1","title":"Security update for grafana","vulnerabilityIds":["CVE-2025-12141","CVE-2025-30153","CVE-2026-21725","CVE-2026-25680","CVE-2026-25681","CVE-2026-27136","CVE-2026-28374","CVE-2026-28376","CVE-2026-28379","CVE-2026-28380","CVE-2026-28383","CVE-2026-33376","CVE-2026-33377","CVE-2026-33378","CVE-2026-33380","CVE-2026-33381","CVE-2026-33382","CVE-2026-39821","CVE-2026-39882","CVE-2026-41607","CVE-2026-42502","CVE-2026-42506"]},{"id":"RHSA-2026:68767","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","vulnerabilityIds":["CVE-2026-28374","CVE-2026-28376","CVE-2026-28379","CVE-2026-28380","CVE-2026-28383","CVE-2026-33376","CVE-2026-33377","CVE-2026-33378","CVE-2026-33380","CVE-2026-33381"]},{"id":"WID-SEC-W-2026-1546","title":"Grafana: Mehrere Schwachstellen","vulnerabilityIds":["CVE-2026-28374","CVE-2026-28376","CVE-2026-28379","CVE-2026-28380","CVE-2026-28383","CVE-2026-33377","CVE-2026-33378","CVE-2026-33380","CVE-2026-33381","CVE-2026-33376"]},{"id":"SUSE-SU-2026:2768-1","title":"Security update 5.1.4 for Multi-Linux Manager Client Tools","vulnerabilityIds":["CVE-2022-21698","CVE-2026-25680","CVE-2026-25681","CVE-2026-27136","CVE-2026-28374","CVE-2026-28376","CVE-2026-28379","CVE-2026-28380","CVE-2026-28383","CVE-2026-33376","CVE-2026-33377","CVE-2026-33378","CVE-2026-33380","CVE-2026-33381","CVE-2026-34986","CVE-2026-39821","CVE-2026-40179","CVE-2026-41602","CVE-2026-42151","CVE-2026-42154","CVE-2026-42502","CVE-2026-42506"]}],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-30145","identifiers":["EUVD-2026-30145","CVE-2026-33380"]},"retained":false,"historicalAffected":[]}],"coverage":[]}