ACTIVELY EXPLOITED
CVE-2021-41277: Metabase GeoJSON API Local File Inclusion Vulnerability
| Vendor | Metabase |
|---|---|
| Product | Metabase |
| Actively exploited | Yes |
| Added to CISA KEV | 12 Nov 2024 |
| CISA federal deadline | 3 Dec 2024 |
| Weakness (CWE) | CWE-200 |
Required action (CISA's text)
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Description (NVD)
Metabase contains a local file inclusion vulnerability in the custom map support in the API to read GeoJSON formatted data.
SOURCES
Other Metabase flaws
Data from NVD, CISA KEV, FIRST EPSS and vendor advisories. Updated 10 Nov 2026.