CVE-2026-15815

/// Technical description

Grafana OSS and Grafana Enterprise did not safely resolve symbolic links when

extracting plugin archives. A crafted plugin archive can chain relative symbolic link

entries to escape the plugin installation directory, writing arbitrary files and an

executable backend binary outside that directory. The dropped executable runs with the

privileges of the Grafana server process, resulting in remote code execution.

Plugin archives are extracted before their signature is verified, so a valid plugin

signature does not prevent the write. An operator can therefore be affected by

installing a plugin that appears legitimate, as well as by installing a plugin from an

arbitrary archive using grafana-cli, the GF_INSTALL_PLUGINS environment variable, or

preinstall configuration.

Grafana Enterprise is affected because it includes the same plugin extraction code as

Grafana OSS.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References