This vulnerability in Grafana Loki 2.3.0 involves improper validation of the namespace parameter in the Ruler API endpoint /loki/api/v1/rules/{namespace}. Although CVE-2021-36156 addressed path traversal by validating the parameter after a single URL decode, an attacker can bypass this by double encoding the path traversal sequences. This allows unauthorized reading of files on the system. The CVSS 3.1 base score is 5.3 (medium), reflecting network attack vector, low complexity, no privileges required, no user interaction, and limited confidentiality impact. There is no official remediation or patch available as of the published date.

An attacker can read arbitrary files on the system via the Ruler API endpoint by exploiting the path traversal vulnerability. This leads to limited confidentiality impact without affecting integrity or availability. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the Ruler API endpoint and monitor for suspicious requests involving double encoded path traversal sequences.