Metabase GeoJSON API Local File Inclusion (CVE-2021-41277)

Historical catalog analysis: CISA added this entry on November 12, 2024. The entry reflects catalog information retrieved on August 31, 2026, not a snapshot archived on the inclusion date. Check current vendor guidance before acting.

What the vulnerability is

CVE-2021-41277 is a Local File Inclusion (LFI) vulnerability identified in Metabase. The flaw exists within the API responsible for reading GeoJSON formatted data, specifically affecting the custom map support functionality. This vulnerability is categorized under CWE-200, indicating the potential for the exposure of sensitive information from the local file system.

Exposure and applicability

This vulnerability applies to deployments of Metabase that utilize the GeoJSON API for custom mapping. Organizations running this software as part of their data visualization or business intelligence stack are potentially exposed if the affected API endpoints are reachable. Because LFI allows an attacker to read files from the server’s local storage, the risk is highest in environments where the application process has broad read permissions on the underlying operating system.

Remediation priorities

Based on our analysis of the available data, vulnerability management teams should prioritize the following actions:

1. Identify Affected Assets: Locate all instances of Metabase across the environment and determine if custom map functionality is enabled or exposed via the API.
2. Apply Vendor Mitigations: Prioritize the application of updates or mitigations as specified in the vendor’s security advisories.
3. Evaluate Product Viability: In scenarios where mitigations cannot be applied or are unavailable for a specific legacy version, the organization should consider discontinuing use of the product to eliminate the exposure.

How to validate remediation

To ensure that the risk has been reduced, defenders must move beyond simple version checks. We recommend the following validation approach:

• Configuration Audit: Verify that the specific API endpoints associated with GeoJSON custom map support are either patched or restricted via network-level controls (e.g., WAF or firewall) to prevent unauthorized access.
• Permission Review: Validate that the service account running Metabase operates under the principle of least privilege, limiting its ability to read sensitive system files even if an LFI vulnerability exists.
• Functional Testing: In a staged environment, verify that the mitigation prevents the retrieval of arbitrary local files via the GeoJSON API while maintaining required business functionality.

Limits and open questions

It remains unknown whether this vulnerability has been utilized in known ransomware campaigns. Furthermore, while CISA has provided a remediation deadline for federal agencies, this date is a regulatory requirement for those specific entities and not a technical expiration of the vulnerability’s risk for private organizations. Residual risk persists if the application is deployed with excessive system privileges, as this could amplify the impact of any remaining or undiscovered file inclusion flaws.

Source and editorial note

CVE-2021-41277: Metabase GeoJSON API Local File Inclusion Vulnerability · Source date: November 12, 2024 · Retrieved August 31, 2026.

Material facts are tied to the cited primary source. Recommendations are independent defensive analysis unless attributed to the source. Confirm consequential decisions against current authoritative guidance.

Archive date: November 15, 2024. The displayed post date is assigned three days after the source date to organize this retrospective archive; it does not mean this site published the analysis then. First published by this site: November 04, 2026 at 00:34 UTC.

Request a Vulnerability Assessment