← Database

CVE-2026-33380

MEDIUM CVSS: 6.3 Published: 2026-05-13 Modified: 2026-06-17

Description

A vulnerability in SQL Expressions allows an authenticated attacker to read arbitrary files from the Grafana server's filesystem. Only instances with the sqlExpressions feature toggle enabled are vulnerable.

Affected Platforms

Grafana Grafana

Weakness Type

CWE-552

References