A vulnerability in Grafana’s SQL Expressions feature allows an authenticated user to instruct the server to read and return the contents of any file on the Grafana host’s disk. This flaw is a path traversal vulnerability (CWE-552) and also involves an SQL injection weakness (CWE-89) that allows arbitrary file read. The attack can expose confidential data such as configuration files or local credentials.

Affected systems include installations of Grafana OSS. No specific version range is listed in the advisory, so all instances enabling the sqlExpressions toggle are potentially vulnerable. The vulnerability is only exploitable on instances where the toggle is turned on.

The CVSS score of 6.3 indicates moderate severity. The EPSS score of 0.00012 indicates a low but nonzero exploitation probability, and the issue is not listed in CISA’s KEV catalog. The likely attack vector is inferred: an attacker requires a valid authenticated Grafana session and the sqlExpressions feature toggle must be enabled. Once authenticated, the attacker can read arbitrary files, potentially exposing sensitive data or aiding further exploitation of the host.