CVE-2026-15815

Name of the Vulnerable Software and Affected Versions Grafana OSS (affected versions not specified) Grafana Enterprise (affected versions not specified)

Description An issue exists where symbolic links are not safely resolved during the extraction of plugin archives. A specially crafted archive can use chained relative symbolic link entries to bypass the plugin installation directory, allowing the writing of arbitrary files and an executable backend binary to external locations. Since the executable runs with the privileges of the Grafana server process, this can lead to remote code execution. Because archives are extracted before signature verification, a valid signature does not prevent this action. This can occur when installing plugins via grafana-cli, the GF INSTALL PLUGINS environment variable, or preinstall configuration.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.