7.6

CVE-2026-50147

Metabase: Arbitrary File Read via MySQL Connection Property Injection

Metabase is an open-source business intelligence and embedded analytics tool. From 1.57.0 until 1.57.19.1, 1.58.14.1, 1.59.10, and 1.60.4, an attacker who can configure a Metabase database connection can read arbitrary files from the Metabase server's filesystem by adding unsafe JDBC parameters to a MySQL or MariaDB connection, causing the driver to read files from the Metabase host and expose the contents through queries against the connected database or through validation error messages. This issue is fixed in versions 1.57.19.1, 1.58.14.1, 1.59.10, and 1.60.4.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Metabase ≫ Metabase SwEditionenterprise Version >= 1.57.0 < 1.57.19.1
Metabase ≫ Metabase SwEditionenterprise Version >= 1.58.0 < 1.58.14.1
Metabase ≫ Metabase SwEditionenterprise Version >= 1.59.0 < 1.59.10
Metabase ≫ Metabase SwEditionenterprise Version >= 1.60.0 < 1.60.4
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.2% 0.099
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
security-advisories@github.com 7.6 2.3 4.7
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:N
CWE-88 Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')

The product constructs a string for a command to be executed by a separate component in another control sphere, but it does not properly delimit the intended arguments, options, or switches within that command string.

https://github.com/metabase/metabase/security/advisories/GHSA-mfpj-crjq-xrcp
Vendor Advisory