CVE-2021-43813

Grafana is an open-source platform for monitoring and observability.
Grafana prior to versions 8.3.2 and 7.5.12 contains a directory traversal
vulnerability for fully lowercase or fully uppercase .md files. The
vulnerability is limited in scope, and only allows access to files with the
extension .md to authenticated users only. Grafana Cloud instances have not
been affected by the vulnerability. Users should upgrade to patched
versions 8.3.2 or 7.5.12. For users who cannot upgrade, running a reverse
proxy in front of Grafana that normalizes the PATH of the request will
mitigate the vulnerability. The proxy will have to also be able to handle
url encoded paths. Alternatively, for fully lowercase or fully uppercase
.md files, users can block /api/plugins/./markdown/. without losing any
functionality beyond inlined plugin help text.