ZeroDay Findings
Sign inSign up

Findings

CVE-2021-41277

Metabase GeoJSON API Local File Inclusion Vulnerability

Published Nov 17, 2021 · updated Oct 8, 2026 · metabase metabase

Metabase is an open source data analytics platform. In affected versions a security issue has been discovered with the custom GeoJSON map ( ) support and potential local file inclusion (including environment variables). URLs were not validated prior to being loaded. This issue is fixed in a new maintenance release (0.40.5 and 1.40.5), and any subsequent release after that. If you’re unable to upgrade immediately, you can mitigate this by including rules in your reverse proxy or load balancer or WAF to provide a validation filter before the application.

Timeline

Detection, updates, and resolution for this record.

  1. Nov 17, 2021 · Catalog

    Detected

    Metabase is an open source data analytics platform. In affected versions a security issue has been discovered with the custom GeoJSON map ( ) support and potential local file inclusion (including environment variables). URLs were not validated prior to being loaded. This issue is fixed in a new maintenance release (0.40.5 and 1.40.5), and any subsequent release after that. If you’re unable to upgr

  2. Nov 12, 2024 · CISA KEV

    Known exploited

    Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

  3. Dec 3, 2024 · CISA KEV

    Remediation due

    Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

  4. Oct 8, 2026 · Catalog

    Updated

    Metabase is an open source data analytics platform. In affected versions a security issue has been discovered with the custom GeoJSON map ( ) support and potential local file inclusion (including environment variables). URLs were not validated prior to being loaded. This issue is fixed in a new maintenance release (0.40.5 and 1.40.5), and any subsequent release after that. If you’re unable to upgr

Required action

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

CISA due date Dec 3, 2024

Affected

  • cpe metabase/metabase0.40.0
  • cpe metabase/metabase0.40.1
  • cpe metabase/metabase0.40.2
  • cpe metabase/metabase0.40.3
  • cpe metabase/metabase0.40.4
  • cpe metabase/metabase1.40.0
  • cpe metabase/metabase1.40.1
  • cpe metabase/metabase1.40.2
  • vendor Metabase Metabaseversion unspecified

Sources

  • CISA KEVCVE-2021-41277

    Metabase contains a local file inclusion vulnerability in the custom map support in the API to read GeoJSON formatted data.

    cisa.gov
  • CVE.orgCVE-2021-41277

    Official CVE identifier

    cve.org
  • FIRST EPSSCVE-2021-41277

    30-day exploitation probability 97.2%

    first.org
  • NIST NVDCVE-2021-41277

    Metabase is an open source data analytics platform. In affected versions a security issue has been discovered with the custom GeoJSON map ( ) support and potential local file inclusion (including environment variables). URLs were not

    nvd.nist.gov

References