CVE-2022-32275: Grafana

High severity, CVSS 7.5. EPSS: 9.6% chance of exploitation in the next 30 days.

Grafana 8.4.3 allows reading files via (for example) a /dashboard/snapshot/%7B%7Bconstructor.constructor'/.. /.. /.. /.. /.. /.. /.. /.. /etc/passwd URI. NOTE: the vendor's position is that there is no vulnerability; this request yields a benign error page, not /etc/passwd content

Affected products

• Grafana Grafana: version 8.4.3 only

Published 2022-06-06. Last modified 2026-06-17.