This vulnerability in Grafana OSS arises from the SQL Expressions feature, which when enabled, permits an authenticated attacker to read arbitrary files on the Grafana server's filesystem. The attack requires the attacker to have some level of authentication and the sqlExpressions feature toggle must be enabled for the vulnerability to be exploitable. The CVSS 3.1 vector indicates network attack vector, high attack complexity, low privileges required, no user interaction, and a confidentiality impact classified as high, with no integrity or availability impact. There is no vendor advisory or patch currently available, and no known exploits in the wild have been reported.

An authenticated attacker can read arbitrary files on the Grafana server, potentially exposing sensitive information. The vulnerability does not impact integrity or availability but compromises confidentiality. The attack complexity is high, and the attacker requires low privileges and no user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider disabling the sqlExpressions feature toggle if it is not required to reduce exposure.