Secuno
ENNL
Book demo

CVE-2021-41277

Metabase GeoJSON API Local File Inclusion

10.0 CRITICALActively exploited (CISA KEV)EPSS 97.2%
  1. Published17 Nov 2021
  2. Added to CISA KEV12 Nov 2024
  3. Remediation due3 Dec 2024
Actively exploited (CISA KEV)

Metabase contains a local file inclusion vulnerability in the custom map support in the API to read GeoJSON formatted data.

Added to KEV: 12 Nov 2024Federal remediation due: 3 Dec 2024

Description

Metabase is an open source data analytics platform. In affected versions a security issue has been discovered with the custom GeoJSON map (`admin->settings->maps->custom maps->add a map`) support and potential local file inclusion (including environment variables). URLs were not validated prior to being loaded. This issue is fixed in a new maintenance release (0.40.5 and 1.40.5), and any subsequent release after that. If you’re unable to upgrade immediately, you can mitigate this by including rules in your reverse proxy or load balancer or WAF to provide a validation filter before the application.

CVSS 3.1 breakdown

Attack vectorNetwork
Attack complexityLow
Privileges requiredNone
User interactionNone
ScopeChanged
ConfidentialityHigh
IntegrityHigh
AvailabilityLow
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L

Affected products

Metabase0.40.0 · 0.40.1 · 0.40.2 · 0.40.3

Remediation

No fixed version is recorded in the NVD data. Check the vendor advisory for the latest guidance.

References

Related CVEs

Recent high-severity vulnerabilities sharing a weakness type.

CVE-2026-599768.1
ConvertX is a self-hosted file conversion service. Prior to 0.18.0, the ImageMagick…
CVE-2026-859538.5
Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7…
CVE-2026-783558.7
A path traversal vulnerability in the OTRS SendSupportBundle functionality allows an…
CVE-2026-876908.8
The Metasploit Framework post module post/apple_ios/gather/ios_image_gather is affected…
CVE-2026-1089028.1
pH7Builder (pH7 Social Dating CMS) before 18.5.0 contains a path traversal…
CVE-2026-1058929.8
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')…

Frequently asked

Is CVE-2021-41277 being actively exploited?

Yes. CVE-2021-41277 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added 12 Nov 2024.

How severe is CVE-2021-41277?

CVE-2021-41277 has a CVSS 3.1 base score of 10.0, rated critical. EPSS estimates a 97.2% probability of exploitation.

Which products are affected by CVE-2021-41277?

Affected products include Metabase.

How do I fix CVE-2021-41277?

Apply the vendor's patch or advisory guidance, then verify no affected versions remain across your devices.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2021-41277 against the real software inventory on every managed device, every day. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. Because it is on the CISA KEV list, Secuno flags any affected asset as top-priority automatically. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation worksBook a demo

Get Patch this first every Monday

Five vulnerabilities that matter this week, ranked on real exploitation. Plain language, one email, no spam.

You can unsubscribe with one click from every issue. We handle your details as described in our privacy policy.

Data from the NVD, CISA KEV catalog and FIRST EPSS. CVSS 3.1 base score shown where available.