Bug 2544604

Summary: CVE-2026-15815 grafana: PLUGIN ARCHIVE EXTRACTION ESCAPES THE PLUGIN DIRECTORY, ALLOWING CODE EXECUTION [fedora-all]
Product: [Fedora] Fedora Reporter: Srikanth Balasubramanian <sbalasub>
Component: grafanaAssignee: sfeifer
Status: NEW --- QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: high Docs Contact:
Priority: high    
Version: rawhideCC: agerstmayr, go-sig, jkurik, nathans, sfeifer, wcohen
Target Milestone: ---Keywords: Security, SecurityTracking
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard: {"flaws": ["547e8fdb-a73a-4e2d-aea7-527641f807ba"]}
Fixed In Version: Doc Type: ---
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 2527474    

Description Srikanth Balasubramanian 2026-10-01 12:29:56 UTC 
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.

Short description of the vulnerability: Grafana did not safely resolve symbolic links when extracting plugin archives. A crafted archive can chain relative symbolic-link entries to escape the plugin installation directory, write arbitrary files, and drop an executable backend binary outside that directory. The dropped executable runs with the privileges of the Grafana server process, which is remote code execution. Plugin archives are extracted before their signature is verified, so a valid signature does not prevent the write, and the payload also passes catalogue validation and signing. An instance can therefore be affected by installing a plugin that appears legitimate, as well as by installing a plugin from an arbitrary archive using grafana-cli, the GF_INSTALL_PLUGINS environment variable, or preinstall configuration. 

Affected versions: Grafana OSS and Grafana Enterprise: 12.0.0 to 12.0.10, 12.1.0 to 12.1.10, 12.2.0 to 12.2.10, 12.3.0 to 12.3.11, 12.4.0 to 12.4.9, 13.0.0 to 13.0.7, 13.1.0 to 13.1.4, and 13.2.0. 

Known mitigations: 

Update to one of the private builds listed above. There is no configuration that fully mitigates this beforehand: plugin signing does not help, because extraction runs before signature verification, and catalogue review does not help, because the validator flattens the symbolic links and sees a benign plugin. Until you have updated, reduce exposure by not installing plugins from arbitrary archives, limiting installation to a vetted and pinned set of plugins, and keeping plugin_admin_enabled off where it is not needed.