CVE-2021-41277: Metabase custom GeoJSON map feature allows local file inclusion

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 16 September 2026. Confidence: high.

critical priorityThe flaw is remotely exploitable without authentication, has a high CVSS score, and is listed in CISA KEV with a very high EPSS probability, indicating active exploitation.

What it is

Metabase does not validate URLs supplied through the custom GeoJSON map setting (admin->settings->maps->custom maps->add a map) before loading them. This lets a remote, unauthenticated attacker read local files and environment variables from the server. The flaw is fixed in maintenance releases 0.40.5 and 1.40.5 and later.

Impact

An attacker gains read access to arbitrary local files and environment variables on the Metabase host, which can expose database credentials, API keys and other secrets. There is no integrity or availability impact per the CVSS vector.

Attack surface

Reachable over the network via the GeoJSON map loading path with no authentication and no user interaction required (CVSS:3.1/AV:N/AC:L/PR:N/UI:N). The description does not state whether the vulnerable endpoint is exposed by default or only after a custom map is configured.

Exploitation

CVE-2021-41277 is listed in CISA KEV (added 2024-11-12, due 2024-12-03) and has an EPSS 30-day probability of 0.97178 (99.89th percentile), indicating active exploitation. No ransomware campaign use is recorded.

What to do

• Upgrade Metabase to 0.40.5, 1.40.5 or any later release.
• If immediate upgrade is not possible, add validation rules in the reverse proxy, load balancer or WAF to filter GeoJSON map URLs before they reach the application.
• Restrict network access to the Metabase instance so it is not reachable from untrusted networks.
• Rotate any credentials or secrets that may have been exposed through environment variables or local files.
• Monitor vendor advisories for further guidance on this issue.

Detection

• Review Metabase logs for requests to the custom GeoJSON map endpoint with external or file-based URLs.
• Inspect reverse proxy, load balancer and WAF logs for URL patterns referencing local files or environment variables.
• Search for unexpected outbound requests from the Metabase host to attacker-controlled URLs.
• Check for unauthorized changes to the custom maps configuration under admin settings.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.