CVE-2021-41277
GeoJSON URL validation can expose server files and environment variables to unauthorized users
Metabase is an open source data analytics platform. In affected versions a security issue has been discovered with the custom GeoJSON map (admin->settings->maps->custom maps->add a map) support and potential local file inclusion (including environment variables). URLs were not validated prior to being loaded. This issue is fixed in a new maintenance release (0.40.5 and 1.40.5), and any subsequent release after that. If you’re unable to upgrade immediately, you can mitigate this by including rules in your reverse proxy or load balancer or WAF to provide a validation filter before the application.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
GeoJSON URL validation can expose server files and environment variables to unauthorized users
Metabase is an open source data analytics platform. In affected versions a security issue has been discovered with the custom GeoJSON map (admin->settings->maps->custom maps->add a map) support and potential local file inclusion (including environment variables). URLs were not validated prior to being loaded. This issue is fixed in a new maintenance release (0.40.5 and 1.40.5), and any subsequent release after that. If you’re unable to upgrade immediately, you can mitigate this by including rules in your reverse proxy or load balancer or WAF to provide a validation filter before the application.
- Record
CVE-2021-41277- CVSS 3.1
- 10.0 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L - Weakness
- CWE-200
- Updated
- 2026-11-02
EUVDEUVD-2021-28310
Metabase is an open source data analytics platform. In affected versions a security issue has been discovered with the custom GeoJSON map (admin->settings->maps->custom maps->add a map) support and potential local file inclusion (including environment variables). URLs were not validated prior to being loaded. This issue is fixed in a new maintenance release (0.40.5 and 1.40.5), and any subsequent release after that. If you’re unable to upgrade immediately, you can mitigate this by including rules in your reverse proxy or load balancer or WAF to provide a validation filter before the application.
- Record
EUVD-2021-28310- CVSS 3.1
- 10.0 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L - Updated
- 2026-11-02
CISA KEV No score
Metabase GeoJSON API Local File Inclusion Vulnerability
Metabase contains a local file inclusion vulnerability in the custom map support in the API to read GeoJSON formatted data.
- Record
CVE-2021-41277- Weakness
- CWE-200
- Updated
- 2026-11-02
NVD
Metabase is an open source data analytics platform. In affected versions a security issue has been discovered with the custom GeoJSON map (admin->settings->maps->custom maps->add a map) support and potential local file inclusion (including environment variables). URLs were not validated prior to being loaded. This issue is fixed in a new maintenance release (0.40.5 and 1.40.5), and any subsequent release after that. If you’re unable to upgrade immediately, you can mitigate this by including rules in your reverse proxy or load balancer or WAF to provide a validation filter before the application.
- Record
CVE-2021-41277- CVSS 3.1
- 10.0 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:P/I:N/A:N - Weakness
- CWE-200, CWE-22
- Updated
- 2026-11-02
OSV
Metabase is an open source data analytics platform. In affected versions a security issue has been discovered with the custom GeoJSON map (admin->settings->maps->custom maps->add a map) support and potential local file inclusion (including environment variables). URLs were not validated prior to being loaded. This issue is fixed in a new maintenance release (0.40.5 and 1.40.5), and any subsequent release after that. If you’re unable to upgrade immediately, you can mitigate this by including rules in your reverse proxy or load balancer or WAF to provide a validation filter before the application.
- Record
CVE-2021-41277- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
Affected products
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| PoC in GitHub | tahtaciburak/CVE-2021-41277 | 2021-11-21 |
| PoC in GitHub | Henry4E36/Metabase-cve-2021-41277 | 2021-11-22 |
| PoC in GitHub | kap1ush0n/CVE-2021-41277 | 2021-11-22 |
| PoC in GitHub | z3n70/CVE-2021-41277 | 2021-11-22 |
| PoC in GitHub | Vulnmachines/Metabase_CVE-2021-41277 | 2021-11-23 |
| PoC in GitHub | kaizensecurity/CVE-2021-41277 | 2021-11-23 |
| PoC in GitHub | TheLastVvV/CVE-2021-41277 | 2021-11-24 |
| PoC in GitHub | zer0yu/CVE-2021-41277 | 2021-12-06 |
| PoC in GitHub | sasukeourad/CVE-2021-41277_SSRF | 2022-01-10 |
| PoC in GitHub | grey-master-a/Metabase_Nmap_Script | 2022-01-19 |
| PoC in GitHub | chengling-ing/CVE-2021-41277 | 2022-03-11 |
| PoC in GitHub | RubXkuB/PoC-Metabase-CVE-2021-41277 | 2023-04-24 |
| Nuclei | Metabase - Local File Inclusion |
History
| Recorded | Changed | Sources |
|---|---|---|
| exploitation, exploits | ||
| first indexed | CVE List, EUVD, CISA KEV, Nuclei, NVD, OSV, PoC in GitHub |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2021-41277 is a critical vulnerability (CVSS 10.0) in Metabase, published November 17, 2021. CISA lists it as known to be exploited, since November 12, 2024. EUVD reports exploitation since November 12, 2024. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 97.2%, the 99th percentile. No source names a fixed version.