Vulnerability record

CVE-2021-41277

Metabase GeoJSON API Local File Inclusion Vulnerability

HighExploitation confirmedCISA KEV

What should I do?

This vulnerability is in the CISA Known Exploited Vulnerabilities catalog: attackers are using it. If you run Metabase, fix it now.

CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

US federal civilian agencies must remediate by Dec 3, 2024.

Patch status

Official fix available since Sep 30, 2026

Apply the vendor's update to every affected system. Check the fixed-in versions below where known.

Basis: NVD patch reference

Patch or advisory on github.com (opens in a new tab)

Description

Metabase is an open source data analytics platform. In affected versions a security issue has been discovered with the custom GeoJSON map (`admin->settings->maps->custom maps->add a map`) support and potential local file inclusion (including environment variables). URLs were not validated prior to being loaded. This issue is fixed in a new maintenance release (0.40.5 and 1.40.5), and any subsequent release after that. If you’re unable to upgrade immediately, you can mitigate this by including rules in your reverse proxy or load balancer or WAF to provide a validation filter before the application.

Source: NIST National Vulnerability Database. Official vulnerability data, reproduced as published.

Affected products

Products affected by this vulnerability, with versions and the source of each entry
Product	Vendor	Affected versions	Source
Metabase	Metabase	0.40.0; 0.40.1; 0.40.2; 0.40.3; 0.40.4; 1.40.0	KEV

Sources: KEV = CISA Known Exploited Vulnerabilities catalog.

Intelligence timeline

Developments from the last 30 days, newest first.

CVSS scoredUpdateKEVSep 30, 2026
CVE-2021-41277 scored CVSS 7.5: Metabase Metabase, Metabase GeoJSON API Local File Inclusion Vulnerability
CISA lists this as exploited in the wild. Unpatched Metabase systems are exposed to active attacks now.
Basis: NIST National Vulnerability Database
Patch releasedUpdateKEVSep 30, 2026
Patch released for CVE-2021-41277: Metabase Metabase, Metabase GeoJSON API Local File Inclusion Vulnerability
An official fix is now available for Metabase Metabase. This vulnerability is being exploited, so apply it promptly.
Basis: NVD patch reference

1 earlier event is available with a subscription. See plans.

Coverage

We have not published a story about this vulnerability yet.

References

github.com https://github.com/metabase/metabase/security/advisories/GHSA-w73v-6p7p-fpfr
nvd.nist.gov https://nvd.nist.gov/vuln/detail/CVE-2021-41277
github.com https://github.com/metabase/metabase/commit/042a36e49574c749f944e19cf80360fd3dc322f0
cisa.gov https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-41277