VULNERABILITY INTELLIGENCE

CVE-2021-41277

CVSS score10 CRITICAL

EPSS probability97.18%

CISA KEVKnown exploited vulnerability

Published2021-11-17

Last modified2026-10-08

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L

Known Exploited Vulnerability

Metabase GeoJSON API Local File Inclusion Vulnerability

Vendor / product: Metabase / Metabase

Description

Metabase is an open source data analytics platform. In affected versions a security issue has been discovered with the custom GeoJSON map (`admin->settings->maps->custom maps->add a map`) support and potential local file inclusion (including environment variables). URLs were not validated prior to being loaded. This issue is fixed in a new maintenance release (0.40.5 and 1.40.5), and any subsequent release after that. If you’re unable to upgrade immediately, you can mitigate this by including rules in your reverse proxy or load balancer or WAF to provide a validation filter before the application.

Weakness classification

security-advisories@github.com: CWE-200
nvd@nist.gov: CWE-22

Primary references

security-advisories@github.com — Patch
security-advisories@github.com — Mitigation, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108 — Patch
af854a3a-2127-422b-91ae-364da2661108 — Mitigation, Third Party Advisory
134c704f-9b21-4f2e-91b3-4a467353bcc0 — US Government Resource