CVE-2021-41277

Status: AnalyzedHigh (7.5)⚠ Active exploitation💥 Exploit

Metabase is an open source data analytics platform. In affected versions a security issue has been discovered with the custom GeoJSON map (`admin->settings->maps->custom maps->add a map`) support and potential local file inclusion (including environment variables). URLs were not validated prior to being loaded. This issue is fixed in a new maintenance release (0.40.5 and 1.40.5), and any subsequent release after that. If you’re unable to upgrade immediately, you can mitigate this by including rules in your reverse proxy or load balancer or WAF to provide a validation filter before the application.

CVSS

Version: 3.1
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Base score: 7.5

Exploitation probability (EPSS)

Probability of exploitation in the next 30 days: 97%
Percentile among all scored CVEs: 100
Score date: 10/6/2026

EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).

CISA KEV — actively exploited

Added to catalog: 11/12/2024
Remediation due date: 12/3/2024
Known ransomware use: Unknown

💥 Public exploits

Exploit code or detection templates are publicly available. This is not the same as confirmed active exploitation (KEV), but it raises the risk: patch with priority.

Nuclei template (automated mass detection) · Metabase - Local File Inclusion
Proof of concept on GitHub (unverified) · List of proofs of concept on GitHub

⚠️ GitHub proofs of concept are not verified: some are fake or contain malware. Never run them outside an isolated lab.

🎯 ATT&CK techniques

How this vulnerability is exploited and what the attacker gains, in MITRE ATT&CK terms.

ExploitationT1190 Exploit Public-Facing Applicationinitial access92 %
Primary impactT1005 Data from Local Systemcollection88 %
Secondary impactT1552 Unsecured Credentialscredential access75 %

AV:N sin autenticación requerida permite explotación remota de aplicación web (T1190). LFI sin validación de URLs expone datos locales e variables de entorno (T1005, T1552).

Inferred by our analysis agent from the official description, CVSS vector and CWE, and checked by a supervisor. May contain errors.

🛡️ ATT&CK mitigations that cover these techniques

Privileged Account Management Limit Access to Resource Over Network Filter Network Traffic Update Software Active Directory Configuration Vulnerability Scanning

Affected technologies (1)

Metabase — Metabase

CWEs

CWE-200
CWE-22

References

Raw JSON (NVD)

Show

{
  "id": "CVE-2021-41277",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2021-41277",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "active"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-08-20T03:56:21.253891Z"
        }
      }
    ],
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
          "authentication": "NONE",
          "integrityImpact": "NONE",
          "accessComplexity": "LOW",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 10,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "LOW",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 6,
        "exploitabilityScore": 3.9
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "metabase",
          "product": "metabase",
          "versions": [
            {
              "status": "affected",
              "version": "< 0.40.5"
            },
            {
              "status": "affected",
              "version": ">= 1.0.0, < 1.40.5"
            }
          ]
        }
      ]
    }
  ],
  "published": "2021-11-17T20:15:10.587",
  "references": [
    {
      "url": "https://github.com/metabase/metabase/commit/042a36e49574c749f944e19cf80360fd3dc322f0",
      "tags": [
        "Patch"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/metabase/metabase/security/advisories/GHSA-w73v-6p7p-fpfr",
      "tags": [
        "Mitigation",
        "Third Party Advisory"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/metabase/metabase/commit/042a36e49574c749f944e19cf80360fd3dc322f0",
      "tags": [
        "Patch"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://github.com/metabase/metabase/security/advisories/GHSA-w73v-6p7p-fpfr",
      "tags": [
        "Mitigation",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-41277",
      "tags": [
        "US Government Resource"
      ],
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-200"
        }
      ]
    },
    {
      "type": "Secondary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Metabase is an open source data analytics platform. In affected versions a security issue has been discovered with the custom GeoJSON map (`admin->settings->maps->custom maps->add a map`) support and potential local file inclusion (including environment variables). URLs were not validated prior to being loaded. This issue is fixed in a new maintenance release (0.40.5 and 1.40.5), and any subsequent release after that. If you’re unable to upgrade immediately, you can mitigate this by including rules in your reverse proxy or load balancer or WAF to provide a validation filter before the application."
    },
    {
      "lang": "es",
      "value": "Metabase es una plataforma de análisis de datos de código abierto. En las versiones afectadas se ha detectado un problema de seguridad con el soporte de mapas GeoJSON personalizados (\"admin-&gt;settings-&gt;maps-&gt;custom maps-&gt;add a map\") y la posible inclusión de archivos locales (incluyendo variables de entorno). Las URLs no se comprueban antes de ser cargadas. Este problema se ha corregido en una nueva versión de mantenimiento (0.40.5 y 1.40.5), y en cualquier otra versión posterior. Si no puede actualizar inmediatamente, puede mitigar esto incluyendo reglas en su proxy inverso o balanceador de carga o WAF para proporcionar un filtro de comprobación antes de la aplicación."
    }
  ],
  "lastModified": "2026-10-08T10:34:41.120",
  "cisaActionDue": "2024-12-03",
  "cisaExploitAdd": "2024-11-12",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:metabase:metabase:0.40.0:-:*:*:-:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "AF64F422-9B51-4949-A9B3-459C77B37C8B"
            },
            {
              "criteria": "cpe:2.3:a:metabase:metabase:0.40.1:*:*:*:-:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3F3694D1-A2D8-4451-B4E2-498EDF5B93C6"
            },
            {
              "criteria": "cpe:2.3:a:metabase:metabase:0.40.2:*:*:*:-:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7BA0D68D-DF27-4726-A893-8D1BCAA39842"
            },
            {
              "criteria": "cpe:2.3:a:metabase:metabase:0.40.3:*:*:*:-:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B2C59AA8-0BA6-4EB1-9121-D84C805E6A9C"
            },
            {
              "criteria": "cpe:2.3:a:metabase:metabase:0.40.4:*:*:*:-:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BB23EBC1-F524-416B-99F6-143B97D64B01"
            },
            {
              "criteria": "cpe:2.3:a:metabase:metabase:1.40.0:-:*:*:enterprise:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "310FB743-2F8A-415C-AF7B-20BCEF0C464E"
            },
            {
              "criteria": "cpe:2.3:a:metabase:metabase:1.40.1:*:*:*:enterprise:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "511B7873-4908-4B1B-B55B-DC90A3BBE659"
            },
            {
              "criteria": "cpe:2.3:a:metabase:metabase:1.40.2:*:*:*:enterprise:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5C9DE222-5F6B-42E3-9B5B-DB9EE05C4FD4"
            },
            {
              "criteria": "cpe:2.3:a:metabase:metabase:1.40.3:*:*:*:enterprise:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "FA1F16C0-63AA-49B5-A28D-D63BA97D07B3"
            },
            {
              "criteria": "cpe:2.3:a:metabase:metabase:1.40.4:*:*:*:enterprise:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5AA701CB-58B6-4B17-ABCC-B12F2DB9F2A3"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "cisaRequiredAction": "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.",
  "cisaVulnerabilityName": "Metabase GeoJSON API Local File Inclusion Vulnerability"
}