Metabase GeoJSON Custom Map Local File Inclusion (LFI) and Information Disclosure Vulnerability (CVE-2021-41277)
Executive & SecOps Summary
SECOPS ASSESSMENTMetabase versions prior to 0.40.5 and 1.40.5 (including all 0.40.x and 1.40.x releases below these versions)
Unauthenticated remote attackers can exploit directory traversal to read arbitrary system files and environment variables from the server
Immediately upgrade to patched Metabase versions (0.40.5, 1.40.5 or later) or block the vulnerable API path using a reverse proxy or WAF
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND1. Official Patch & Version Upgrade Commands
The recommended remediation is to upgrade Metabase to a secure maintenance release (0.40.5, 1.40.5, or higher). If running Metabase via Docker, use the following commands to update your container:
# 1. Stop and remove the vulnerable Metabase container
docker stop metabase-app
docker rm metabase-app
# 2. Pull and run the patched Metabase version (v0.40.5 or higher)
docker pull metabase/metabase:v0.40.5
docker run -d -p 3000:3000 --name metabase-app metabase/metabase:v0.40.52. Temporary Workaround & Hardening Configuration
If an immediate upgrade is not feasible, configure your reverse proxy, load balancer, or WAF to block external access to the vulnerable /api/geojson endpoint.
# Nginx reverse proxy mitigation configuration
server {
listen 80;
server_name metabase.internal.zone;
# Block access to the vulnerable geojson API endpoint
location /api/geojson {
return 403 'Access Denied: Security Mitigation Active';
}
location / {
proxy_pass http://127.0.0.1:3000;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
}
}3. Log Audit & IoC Verification Commands
Inspect your web server access logs for suspicious requests targeting the /api/geojson endpoint containing directory traversal patterns or local file protocols.
# Search Nginx/Apache access logs for LFI exploitation attempts
grep -Ei 'api/geojson.*(file:|\.\./|\.\.%2f|etc/passwd|env)' /var/log/nginx/access.logBlock Exploits Instantly with Managed Virtual Patching Rules
Can't patch production immediately? Deploy managed WAF rules at the edge to intercept RCE, SQLi, and deserialization payloads before they hit your origin server.
Technical Root Cause & Exploitation Mechanics
1. Vulnerability Overview & Root Cause
This vulnerability exists in the custom GeoJSON map support (admin->settings->maps->custom maps->add a map) of Metabase, an open-source data analytics platform. Due to insufficient input validation (CWE-22, CWE-200) of user-supplied URLs before loading them, the application is susceptible to Local File Inclusion (LFI). Attackers can leverage directory traversal sequences or local file protocols to access arbitrary files on the hosting server.
2. Exploitation Mechanics & Attack Scenario
An unauthenticated attacker can directly send crafted HTTP requests to the /api/geojson endpoint. By manipulating the url parameter (e.g., using file:/etc/passwd or file:///etc/passwd), the attacker bypasses validation checks. The Metabase backend server processes this local file URI and returns the contents of the requested file in the HTTP response body, exposing sensitive system configurations and environment variables.
3. Infrastructure & Business Impact
This vulnerability is actively exploited in the wild and is listed in the CISA KEV catalog. Successful exploitation allows attackers to harvest database credentials, API keys, and environment variables. This exposure can lead to full infrastructure compromise, unauthorized database access, and severe data breaches, posing a critical risk to business operations.
Official Vendor Advisories & References
Metabase is an open source data analytics platform. In affected versions a security issue has been discovered with the custom GeoJSON map (`admin->settings->maps->custom maps->add a map`) support and potential local file inclusion (including environment variables). URLs were not validated prior to being loaded. This issue is fixed in a new maintenance release (0.40.5 and 1.40.5), and any subsequent release after that. If you’re unable to upgrade immediately, you can mitigate this by including rules in your reverse proxy or load balancer or WAF to provide a validation filter before the application.
Frequently Asked SecOps Questions (CVE-2021-41277)
FAQQ1. How critical is CVE-2021-41277 and is it actively exploited in the wild?
CVE-2021-41277 is rated CVSS 7.5 (HIGH) with a 30-day EPSS exploitation probability of 97.2%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.
Q2. Which vendors and products are affected by CVE-2021-41277?
Primary impacted vendors include metabase across metabase. Scope summary: Metabase versions 0.40.0 through 0.40.4, and 1.40.0 through 1.40.4 (all versions prior to 0.40.5 and 1.40.5)
Q3. What temporary mitigations or workarounds exist for CVE-2021-41277 before patching?
[Mitigation] Immediately upgrade to patched Metabase versions (0.40.5, 1.40.5 or later) or block the vulnerable API path using a reverse proxy or WAF Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.
Generate an Internal Engineering Notice or CISO Report for CVE-2021-41277
Instantly format this advisory into an executive CISO summary or engineering patch ticket.
🔗 Related Advisories in Similar Stack (metabase)
View Category →Metabase /reset_password Endpoint Unauthenticated SQL Injection and Admin Takeover (CVE-2026-72898)
[Affected Scope] Unpatched active instances of Metabase Open Source and Enterprise editions
Adobe ColdFusion Path Traversal Remote Code Execution Vulnerability Urgent Advisory (CVE-2026-48282)
[Affected Scope] Adobe ColdFusion versions 2025.9, 2023.20 and earlier
WebDyne Perl Framework Path Traversal and Remote Code Execution (RCE) Vulnerability Advisory (CVE-2026-78189)
[Affected Scope] Perl web applications utilizing WebDyne versions 3.007 through 3.021
WordPress Payment Forms for Paystack Plugin API Secret Key Disclosure Vulnerability (CVE-2026-110042)
[Affected Scope] Payment Forms for Paystack WordPress plugin versions before 4.0.6
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.