Evidence dossier

CVE-2021-41277

GeoJSON URL validation can expose server files and environment variables to unauthorized users

72.2–99.7Priority evidence range

As known Jul 19, 2026, 5:00 AM UTCgen-56ccdaf9

Normalized restatement

Metabase is an open source data analytics platform. In affected versions a security issue has been discovered with the custom GeoJSON map (`admin->settings->maps->custom maps->add a map`) support and potential local file inclusion (including environment variables). URLs were not validated prior to being loaded. This issue is fixed in a new maintenance release (0.40.5 and 1.40.5), and any subsequent release after that. If you’re unable to upgrade immediately, you can mitigate this by including rules in your reverse proxy or load balancer or WAF to provide a validation filter before the application.

State: PUBLISHED
Published: Nov 17, 2021
Updated: Oct 21, 2025
Evidence coverage: 72%

CISA KEVCatalog member

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

FIRST EPSS97.18%

2026-07-18 · v2026.06.15 · percentile 99.9%

Source stateConflict visible

Distinct CVSS assessments remain side by side; none are averaged.

Source comparison

Who said what

CISA-ADPindependent enrichment

container

CISA ADP Vulnrichment

Jul 19, 2026Original evidence ↗

CVEderivative copy

container

CVE Program Container

Jul 19, 2026Original evidence ↗

GitHub_Moriginal assertion

container

GeoJSON URL validation can expose server files and environment variables to unauthorized users

Jul 19, 2026Original evidence ↗

CISA KEVoriginal assertion

observed_exploitation

Metabase GeoJSON API Local File Inclusion Vulnerability

Jul 19, 2026Original evidence ↗

FIRST EPSSoriginal assertion

model_probability

Probability 0.971780000000; percentile 0.998870000000

Jul 19, 2026Original evidence ↗

Applicability

Cited product scope

Trace impact →

metabasemetabase

[{"status": "affected", "version": "0", "lessThan": "0.40.5", "versionType": "custom"}, {"status": "affected", "version": "1.0.0", "lessThan": "1.40.5", "versionType": "custom"}]

unknown

metabasemetabase

[{"status": "affected", "version": "0", "lessThan": "0.40.5", "versionType": "custom"}, {"status": "affected", "version": "1.0.0", "lessThan": "1.40.5", "versionType": "custom"}]

unknown

metabasemetabase

[{"status": "affected", "version": "< 0.40.5"}, {"status": "affected", "version": ">= 1.0.0, < 1.40.5"}]unknown