{"id":"GHSA-gxcp-jjxh-rwp4","revision":"89c96546de4047dcb0102fcb6e6e0887","records":[{"revision":"89c96546de4047dcb0102fcb6e6e0887","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GHSA-gxcp-jjxh-rwp4","aliases":["BIT-grafana-2026-33380","CVE-2026-33380","GO-2026-5409"],"title":"Grafana: SQL Expressions Read File From Disk","description":"A vulnerability in SQL Expressions allows an authenticated attacker to read arbitrary files from the Grafana server's filesystem. Only instances with the sqlExpressions feature toggle enabled are vulnerable.","state":0,"publishedAt":"2026-05-13T21:32:06+00:00","modifiedAt":"2026-09-10T03:51:05.7297735+00:00","affected":[{"ecosystem":"Go","name":"github.com/grafana/grafana","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"1.9.2-0.20260513165311-fb7336fc36c1"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"MODERATE"}],"references":["https://nvd.nist.gov/vuln/detail/CVE-2026-33380","https://github.com/grafana/grafana/commit/fb7336fc36c14e1ff869482c5085ddb9f39e1b86","https://github.com/grafana/grafana","https://grafana.com/security/security-advisories/cve-2026-33380"],"sourceUrl":"https://github.com/advisories/GHSA-gxcp-jjxh-rwp4","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-gxcp-jjxh-rwp4","identifiers":["GHSA-gxcp-jjxh-rwp4","BIT-grafana-2026-33380","CVE-2026-33380","GO-2026-5409"]},"retained":false,"historicalAffected":[]}],"coverage":[]}