CVE-2021-41277

    Dashboard / Vulnerabilities / CVE-2021-41277

    CVE-2021-41277

    Published: 17 Nov 2021Last Modified: 9 Jul 2026

    Summary:

    Details: Metabase is an open source data analytics platform. In affected versions a security issue has been discovered with the custom GeoJSON map (`admin->settings->maps->custom maps->add a map`) support and potential local file inclusion (including environment variables). URLs were not validated prior to being loaded. This issue is fixed in a new maintenance release (0.40.5 and 1.40.5), and any subsequent release after that. If you’re unable to upgrade immediately, you can mitigate this by including rules in your reverse proxy or load balancer or WAF to provide a validation filter before the application.

    References: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-41277, https://github.com/metabase/metabase/security/advisories/GHSA-w73v-6p7p-fpfr, https://github.com/metabase/metabase/commit/042a36e49574c749f944e19cf80360fd3dc322f0

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 961caedc9983dfef7e25dfdfb0e18c9bde02dca4
    Fixed -None

    Affected versions

    0.40.0-NA
    0.40.1
    0.40.2
    0.40.3
    0.40.4

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2021-41277 | CVE-DB