Metabase - Local File Inclusion (CVE-2021-41277)
321Exploiting IPs reported
Metabase is an open source data analytics platform. In affected versions a security issue has been discovered with the custom GeoJSON map (`admin->settings->maps->custom maps->add a map`) support and potential local file inclusion (including environment variables). URLs were not validated prior to being loaded. This issue is fixed in a new maintenance release (0.40.5 and 1.40.5), and any subsequent release after that. If you’re unable to upgrade immediately, you can mitigate this by including rules in your reverse proxy or load balancer or WAF to provide a validation filter before the application.
CrowdSec analysis
CVE-2021-41277 is a critical vulnerability in Metabase that enables attackers to conduct unauthenticated local file inclusion by leveraging improperly validated custom GeoJSON map URLs.
CrowdSec has been tracking this vulnerability and its exploits since 10th of March 2025.
According to CrowdSec data, while opportunistic exploitation dominates, a portion of threat actors trying to exploit CVE-2021-41277 apply basic targeting methods such as port or service detection. This indicates emerging patterns of selective targeting. Telemetry from the CrowdSec network also shows that exploitation activity for CVE-2021-41277 remains steady week-over-week. Attack volumes are consistent with long-term trends, indicating sustained interest from threat actors. CVE-2021-41277 continues to be an active part of the threat landscape and will likely remain this way for the forseeable future.
Exploitation attempts are notably identified through requests to URLs containing /api/geojson?url=file:///etc/passwd.
Exploitation
Get real-time information about exploitation attempts and actors involved.
Common Weakness Enumeration (CWE)
Protection
Find out relevant information to protect your stack against this CVE.
Blocklist
With our advanced worldwide network detection, CrowdSec can provide a list of IPs known for exploiting the vulnerability.
To increase your protection against this CVE, block exploitation attempts with this list of identified actors.