CVE-2026-110992: Path traversal in Git Sync delete and move jobs
Published Nov 11, 2026
·Updated
A user who can create Git Sync provisioning jobs (the Editor role by default) could delete or move files outside the configured repository path with a job that references a resource whose source path contains ../ sequences (path traversal). With a local filesystem repository on versions before 13.0.4 and 13.1.1, this reached files on the Grafana host.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Grafanato a version that resolves this vulnerability.Fixed in 13.0.4 - Upgrade
Upgrade
Grafanato a version that resolves this vulnerability.Fixed in 13.1.1
Event History
Nov 11, 2026
CVE Published
via MITRE·03:01 PM
Data Sourced
via MITRE·03:01 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·03:17 PM
DescriptionSeverityWeakness