Grafana's SQL Expressions Reached DuckDB, and DuckDB Reaches the Filesystem

A dashboard feature routed expressions through a DuckDB binary, and DuckDB reads files. How CVE-2024-9264 turns a Viewer account into server-side file access, and what the Grafana process leaves within reach.