This vulnerability in Grafana OSS arises from the SQL Expressions feature, which when enabled, allows an authenticated attacker with low privileges to read arbitrary files on the server filesystem. The vulnerability is identified as CWE-552 (Exposure of Sensitive Information to an Unauthorized Actor). The CVSS 3.1 base score is 6.3, reflecting network attack vector, high attack complexity, low privileges required, no user interaction, and a confidentiality impact classified as high. The vulnerability affects multiple versions from 11.6.0 through 13.0.1. No official remediation or patch is currently documented, and the product is not a cloud service, so remediation depends on vendor updates or configuration changes.

An attacker who is authenticated with low privileges can exploit this vulnerability to read arbitrary files on the Grafana server's filesystem, potentially exposing sensitive information. The vulnerability does not affect system integrity or availability but poses a significant confidentiality risk. There are no known exploits in the wild, and the attack complexity is high, requiring the sqlExpressions feature toggle to be enabled.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider disabling the sqlExpressions feature toggle if it is not required, to eliminate exposure. Monitor vendor communications for updates on patches or official mitigations.