---
id: CVE-2021-36156
aliases:
  - GHSA-grj5-8x6q-hc9q
title: Path traversal in Grafana Loki
summary: Path traversal in Grafana Loki
severity: medium
cvss: 5.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N'
vendor: grafana
product: github.com/grafana/loki
ecosystem: go
affected:
  - github.com/grafana/loki < 2.3.0
patched:
  - github.com/grafana/loki 2.3.0
published: '2021-09-02'
updated: '2026-08-07'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-grj5-8x6q-hc9q'
references:
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2021-36156'
  - url: 'https://github.com/grafana/loki/pull/4020'
  - url: 'https://github.com/grafana/loki/pull/4020#issue-694377133'
  - url: 'https://github.com/grafana/loki'
  - url: 'https://github.com/grafana/loki/releases/tag/v2.3.0'
tags:
  - osv
  - go
epss: 0.01477
epssPercentile: 0.72774
ingestedAt: '2026-08-07T19:14:17.021Z'
---

## Overview

An issue was discovered in Grafana Loki through 2.2.1. The header value X-Scope-OrgID is used to construct file paths for rules files, and if crafted to conduct directory traversal such as ae ../../sensitive/path/in/deployment pathname, then Loki will attempt to parse a rules file at that location and include some of the contents in the error message.

## Affected packages

- `github.com/grafana/loki < 2.3.0`

## Remediation

Upgrade to a patched release:

- `github.com/grafana/loki 2.3.0`