Metabase 0.40.4

Submit a proposal Propose CVE/GCVE/GHSA reference

Approved changes feed: RSS · Atom

cpe:2.3:a:metabase:metabase:0.40.4:*:*:*:-:*:*:*

part: a version: 0.40.4 update: *

VendorMetabase (16827aa7-aefd-5814-83cb-608525e2bffd)
ProductMetabase (4d175b33-6157-5c0a-aff2-86af9d9fe159)
Edition*
Language*
Software edition-
Target software*
Target hardware*
Other*

Notes

Imported from NVD CPE 2.0 feed

PURL mappings

PURLSourceLast updated
pkg:docker/metabase/metabase purl2cpe 2026-06-01 10:15:57.518068
pkg:github/metabase/metabase purl2cpe 2026-06-01 10:15:57.518069
pkg:gitlab/herakles-erp/metabase purl2cpe 2026-06-01 10:15:57.518071
pkg:sourceforge/metabase.mirror purl2cpe 2026-06-01 10:15:57.518072

Vulnerability references

IdentifiercpeApplicabilitySubmitteddb.gcve.eu detailsRationale
CVE:CVE-2021-41277 vulnerable 2026-06-08 05:35:20.101883 GeoJSON URL validation can expose server files and environment variables to unauthorized users
CRITICAL (10)
Metabase is an open source data analytics platform. In affected versions a security issue has been discovered with the custom GeoJSON map (`admin->settings->maps->custom maps->add a map`) support and potential local file inclusion (including environment variables). URLs were not validated prior to being loaded. This issue is fixed in a new maintenance release (0.40.5 and 1.40.5), and any subsequent release after that. If you’re unable to upgrade immediately, you can mitigate this by including rules in your reverse proxy or load balancer or WAF to provide a validation filter before the application.
Published: 2021-11-17T20:05:11.000Z
Updated: 2026-10-07T17:37:15.658Z
Reference links
Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.

Inspect record JSON

Open JSON directly

Open this panel to browse, search, copy or download the JSON record.