CVE-2026-15815

A flaw was found in Grafana. When extracting plugin archives, Grafana did not safely resolve symbolic links. A remote attacker could craft a malicious plugin archive with symbolic links to escape the plugin installation directory. This allows the attacker to write arbitrary files and execute malicious code with the privileges of the Grafana server process, leading to remote code execution.

Important: Grafana's plugin extraction process is vulnerable to symbolic link traversal, enabling an attacker to write arbitrary files and achieve remote code execution with the privileges of the Grafana server. This critical flaw allows malicious code execution even before plugin signature verification, posing a significant risk in Red Hat deployments where Grafana is used.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

While no configuration fully mitigates this issue, exposure can be reduced by limiting plugin installations to vetted and pinned sets of plugins from trusted sources. Additionally, disable the plugin_admin_enabled setting in the Grafana configuration if not required, to prevent non-administrator users from installing plugins. This can be done by setting plugin_admin_enabled = false in the [plugins] section of the grafana.ini configuration file. A restart of the Grafana service may be required for changes to take effect, which could temporarily impact service availability.