Detections
Analytics
CVE-2026-110992
medium
Description
A user who can create Git Sync provisioning jobs (the Editor role by default) could delete or move files outside the configured repository path with a job that references a resource whose source path contains ../ sequences (path traversal). With a local filesystem repository on versions before 13.0.4 and 13.1.1, this reached files on the Grafana host.
References
https://grafana.com/security/security-advisories/cve-2026-110992