{"id":"CVE-2026-33380","published":"2026-05-13T19:28:32Z","modified":"2026-08-27T17:22:19Z","title":"SQL Expressions Read File From Disk","vendor":"Grafana","product":"Grafana OSS","tier":"tail","description":{"text":"A vulnerability in SQL Expressions allows an authenticated attacker to read arbitrary files from the Grafana server's filesystem. Only instances with the sqlExpressions feature toggle enabled are vulnerable.","provenance":"source","from":"CVE.org"},"cvss":{"score":6.3,"severity":"MEDIUM","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.00366,"percentile":0.30348,"provenance":"source"},"cwes":[{"id":"CWE-552","name":"Files or Directories Accessible to External Parties"}],"references":[{"url":"https://grafana.com/security/security-advisories/cve-2026-33380","tags":["vendor-advisory"]}],"priority":{"score":10.5,"factors":[{"name":"EPSS percentile","points":6.07},{"name":"CVSS severity","points":4.41}]},"vendorSlug":"grafana","affectedVersions":[{"vendor":"Grafana","product":"Grafana OSS","versions":[">= 11.6.0, <= 11.6.14",">= 11.6.14, < 11.6.14+security-04",">= 12.0.0, <= 12.2.8",">= 12.2.8, < 12.2.8+security-04",">= 12.3.0, <= 12.3.6",">= 12.3.6, < 12.3.6+security-04",">= 12.4.0, <= 12.4.3",">= 12.4.3, < 12.4.3+security-02",">= 13.0.0, <= 13.0.1",">= 13.0.1, < 13.0.1+security-01"]}],"affected":[{"ecosystem":"Go","package":"github.com/grafana/grafana","vulnerableRanges":["<1.9.2-0.20260513165311-fb7336fc36c1","all versions"],"patched":["1.9.2-0.20260513165311-fb7336fc36c1"],"from":["GHSA-gxcp-jjxh-rwp4","GO-2026-5409"],"provenance":"source"}],"euvd":{"id":"EUVD-2026-30145","exploited":false,"provenance":"source"},"lineage":{"packageHistory":[{"cve":"CVE-2025-6023","published":"2025-07-18","fixed":"1.9.2-0.20250521205822-0ba0b99665a9","kev":false},{"cve":"CVE-2026-21727","published":"2026-04-15","fixed":"1.9.2-0.20260127141016-e702db6096e0","kev":false},{"cve":"CVE-2026-21724","published":"2026-03-26","fixed":"1.9.2-0.20260323180334-daffe750de85","kev":false},{"cve":"CVE-2026-33380","published":"2026-05-13","fixed":"1.9.2-0.20260513165311-fb7336fc36c1","kev":false},{"cve":"CVE-2026-33381","published":"2026-05-13","fixed":"1.9.2-0.20260513165311-fb7336fc36c1","kev":false},{"cve":"CVE-2018-12099","published":"2018-06-11","fixed":"5.2.0-beta1+incompatible","kev":false},{"cve":"CVE-2018-15727","published":"2018-08-29","fixed":"5.2.3+incompatible","kev":false},{"cve":"CVE-2026-27877","published":"2026-03-27","fixed":"12.4.2","kev":false,"link":{"from":"CVE-2026-27877","to":"CVE-2026-33380","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Go:github.com/grafana/grafana","fromFixed":"1.9.2-0.20260325055210-3522153e07b4","toFixed":"1.9.2-0.20260513165311-fb7336fc36c1","daysApart":47}]}}],"package":"Go:github.com/grafana/grafana"}}