CVE-2026-110992
MEDIUM
NVD
CVSS Score
6.5
Severity
MEDIUM
Published
Nov 11, 2026
Vendor
unknown
Description
A user who can create Git Sync provisioning jobs (the Editor role by default) could delete or move files outside the configured repository path with a job that references a resource whose source path contains ../ sequences (path traversal). With a local filesystem repository on versions before 13.0.4 and 13.1.1, this reached files on the Grafana host.