# CVE-2021-41277: Metabase GeoJSON API Local File Inclusion Vulnerability

Source: https://junglewise.ai/threats/cve-2021-41277-metabase-geojson-api-local-file-inclusion-vulnerability  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2024-11-12. Updated: 2026-05-09  
License: CC BY 4.0 with a link back

CVE-2021-41277 · Severity: critical · CVSS 10 · Exploited in the wild · Published 2024-11-12

Metabase contains a local file inclusion (LFI) vulnerability in its custom GeoJSON map support. Due to a lack of URL validation when adding custom maps, an unauthenticated attacker can read local files and environment variables.

Technologies: [Metabase](https://junglewise.ai/threats/technologies/metabase). Vendors: [Metabase](https://junglewise.ai/threats/vendors/metabase).

## Quick answers

**Is CVE-2021-41277 exploited in the wild?** Yes. CVE-2021-41277 is known to be exploited in the wild, first recorded on 12 November 2024. Treat it as urgent.

**How severe is CVE-2021-41277?** Critical severity, with a CVSS score of 10, published 12 November 2024.

**Which products and versions are affected?** Metabase Metabase 0.40.0 to 0.40.4, 1.40.0 to 1.40.4.

**Is there a fix for CVE-2021-41277?** A patch was published on 2021-11-17: Fixed in versions 0.40.5 and 1.40.5 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2021-41277 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2021-41277?** Check whether you run Metabase. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Affected products

- Metabase Metabase 0.40.0 to 0.40.4, 1.40.0 to 1.40.4

## Timeline

- 2021-11-17: disclosed: Original GitHub advisory publication date (implied by CVE year and patch history)
- 2024-11-12: kev added: Added to CISA Known Exploited Vulnerabilities Catalog
- 2024-11-12: exploited: Confirmed active exploitation in the wild per CISA KEV entry.
- 2021-11-17: patched: Fixed in versions 0.40.5 and 1.40.5

## Related threats

- [Metabase unrestricted H2 functions in native queries](https://junglewise.ai/threats/cve-2026-103928-metabase-is-an-open-source-business-intelligence-and-analytics)
- [Metabase GeoJSON SSRF via 0.0.0.0 address bypass](https://junglewise.ai/threats/cve-2026-92813-metabase-geojson-ssrf-via-0-0-0-0-address-bypass)
- [Metabase glossary API missing authorization checks](https://junglewise.ai/threats/cve-2026-86116-metabase-glossary-api-missing-authorization-checks)
- [Metabase information disclosure via native SQL queries](https://junglewise.ai/threats/cve-2026-72900-metabase-information-disclosure-via-native-sql-queries)
- [Metabase SQL injection in publicly shared dashboards](https://junglewise.ai/threats/cve-2026-72899-metabase-sql-injection-in-publicly-shared-dashboards)