| Package | Affected versions | Patched versions |
|---|---|---|
| github.com/grafana/loki | all versions | |
| github.com/grafana/loki/v3 | < 3.6.4 | 3.6.4 |
| loki | < 3.6.4 | 3.6.4 |
The CVE-2021-36156 fix validates the namespace parameter for path traversal sequences after a single URL decode, by double encoding, an attacker can read files at the Ruler API endpoint /loki/api/v1/rules/{namespace}
Thanks to Prasanth Sundararajan for reporting this vulnerability.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free