CVE-2021-41277

🗓️ 03 Oct 2026 10:44:02Reported by KitPloitType

kitploit🔗 kitploit.com👁 15 Views

Metabase < 0.40.5 and 1.0.0-1.40.5 local file inclusion via GeoJSON map URLs leaks env vars.

Reporter	Title	Published	Views	Family All 42
GithubExploit	Exploit for Exposure of Sensitive Information to an Unauthorized Actor in Metabase	10 Jan 202201:52	–	githubexploit
GithubExploit	Exploit for Exposure of Sensitive Information to an Unauthorized Actor in Metabase	6 Dec 202108:52	–	githubexploit
GithubExploit	Exploit for Exposure of Sensitive Information to an Unauthorized Actor in Metabase	22 Nov 202102:51	–	githubexploit
GithubExploit	Exploit for Exposure of Sensitive Information to an Unauthorized Actor in Metabase	11 Mar 202206:39	–	githubexploit
GithubExploit	Exploit for Exposure of Sensitive Information to an Unauthorized Actor in Metabase	21 Nov 202111:38	–	githubexploit
GithubExploit	Exploit for Exposure of Sensitive Information to an Unauthorized Actor in Metabase	22 Nov 202112:49	–	githubexploit
GithubExploit	Exploit for Exposure of Sensitive Information to an Unauthorized Actor in Metabase	22 Nov 202118:06	–	githubexploit
GithubExploit	Exploit for Exposure of Sensitive Information to an Unauthorized Actor in Metabase	24 Nov 202105:56	–	githubexploit
attackerkb	CVE-2021-41277	17 Nov 202100:00	–	attackerkb
Circl	CVE-2021-41277	17 Nov 202122:20	–	circl

03 Oct 2026 10:44Current

7High risk

Vulners AI Score7

CVSS 25

CVSS 3.17.5 - 10

EPSS0.97178

SSVC

Metabase Local file inclusion Information disclosure GeoJSON maps Environment variables URL validation