SARA / Free Tools / CVE / CVE-2021-41277

CVE-2021-41277 — Metabase GeoJSON API Local File Inclusion Vulnerability

Metabase is an open source data analytics platform. In affected versions a security issue has been discovered with the custom GeoJSON map (`admin->settings->maps->custom maps->add a map`) support and potential local file inclusion (including environment variables). UR

CVSS
10.0 CRITICAL
EPSS
94.35% (top 0.00%)
CWE
CWE-200
Published
2021-11-17T20:05:11.000Z
Last modified
2025-10-21T23:25:25.131Z
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L
CISA KEV — Actively Exploited
Added to KEV
2024-11-12
BOD 22-01 due
2024-12-03
Ransomware use
Unknown

01What is this vulnerability?

Metabase is an open source data analytics platform. In affected versions a security issue has been discovered with the custom GeoJSON map (`admin->settings->maps->custom maps->add a map`) support and potential local file inclusion (including environment variables). URLs were not validated prior to being loaded. This issue is fixed in a new maintenance release (0.40.5 and 1.40.5), and any…

02Affected products

VendorProductVersions
metabasemetabase< 0.40.5, >= 1.0.0, < 1.40.5

03Active exploitation status

Yes — actively exploited. Added to the CISA KEV catalog on 2024-11-12. Ransomware use: Unknown.

04Recommended remediation

05Technical details

For the full vendor write-up, exploit chains, and reference implementations, see the references list in section 09.

06Detection signatures

Open the Sigma generator with a pre-filled prompt for this CVE to draft a starting detection in your stack of choice:

Open in Sigma generator →

07Related CVEs

No directly-cited follow-up CVEs in the KB record for this advisory. The references list in section 09 carries the vendor cross-references.

08Timeline

09References

Want this in your SOAR or SIEM?
SARA's API returns EPSS, CVSS, KEV, and an analyst-grade summary in one call.
Read the API reference →