CVE-2026-103928 (GCVE-0-2026-103928)
Vulnerability from cvelistv5
Published
2026-10-13 15:44
Modified
2026-10-13 16:08
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-73 - External Control of File Name or Path
Summary
Metabase is an open source business intelligence and analytics platform. From 1.55.0 until 1.58.16, 1.59.13, 1.60.9, and 1.61.4, native queries and actions against an H2 data source are passed through without restricting host-facing built-in functions. A user authorized to run native queries or actions can invoke FILE_READ, FILE_WRITE, CSVREAD, CSVWRITE, or LINK_SCHEMA to read or write arbitrary files on the Metabase server or link other databases. The default sample database uses H2, so the vulnerable surface is exposed by default. This issue is fixed in versions 1.58.16, 1.59.13, 1.60.9, and 1.61.4.
References
| URL | Tags | |
|---|---|---|
|
|
||
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-103928",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-13T16:08:17.357818Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T16:08:31.731Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "metabase",
"vendor": "metabase",
"versions": [
{
"status": "affected",
"version": "\u003e= 1.55.0, \u003c 1.58.16"
},
{
"status": "affected",
"version": "\u003e= 1.59.0, \u003c 1.59.13"
},
{
"status": "affected",
"version": "\u003e= 1.60.0, \u003c 1.60.9"
},
{
"status": "affected",
"version": "\u003e= 1.61.0, \u003c 1.61.4"
},
{
"status": "affected",
"version": "\u003e= 0.55.0, \u003c 0.58.15.3"
},
{
"status": "affected",
"version": "\u003e= 0.59.0, \u003c 0.59.12.1"
},
{
"status": "affected",
"version": "\u003e= 0.60.0, \u003c 0.60.8.1"
},
{
"status": "affected",
"version": "\u003e= 0.61.0, \u003c 0.61.3.4"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Metabase is an open source business intelligence and analytics platform. From 1.55.0 until 1.58.16, 1.59.13, 1.60.9, and 1.61.4, native queries and actions against an H2 data source are passed through without restricting host-facing built-in functions. A user authorized to run native queries or actions can invoke FILE_READ, FILE_WRITE, CSVREAD, CSVWRITE, or LINK_SCHEMA to read or write arbitrary files on the Metabase server or link other databases. The default sample database uses H2, so the vulnerable surface is exposed by default. This issue is fixed in versions 1.58.16, 1.59.13, 1.60.9, and 1.61.4."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-73",
"description": "CWE-73: External Control of File Name or Path",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T15:44:37.906Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/metabase/metabase/security/advisories/GHSA-cwxq-fmxq-jv8h",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/metabase/metabase/security/advisories/GHSA-cwxq-fmxq-jv8h"
},
{
"name": "https://github.com/metabase/metabase/commit/8fb4f0c8a22f195390b4a1d8f5c21db695ae8cc3",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/metabase/metabase/commit/8fb4f0c8a22f195390b4a1d8f5c21db695ae8cc3"
},
{
"name": "https://github.com/metabase/metabase/commit/a943448e90e23dbb78001ddedbb15e9c0794473c",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/metabase/metabase/commit/a943448e90e23dbb78001ddedbb15e9c0794473c"
},
{
"name": "https://github.com/metabase/metabase/commit/abf3fb8427eccefd8d46149cdebe38f3b49f964f",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/metabase/metabase/commit/abf3fb8427eccefd8d46149cdebe38f3b49f964f"
},
{
"name": "https://github.com/metabase/metabase/commit/ae60d1cd156d097f084af43a536b3ab60510c9a4",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/metabase/metabase/commit/ae60d1cd156d097f084af43a536b3ab60510c9a4"
},
{
"name": "https://github.com/metabase/metabase/commit/e231432adcc813a75f3ca4832818bda2d9d265da",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/metabase/metabase/commit/e231432adcc813a75f3ca4832818bda2d9d265da"
},
{
"name": "https://github.com/metabase/metabase/releases/tag/v0.58.15.3",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/metabase/metabase/releases/tag/v0.58.15.3"
},
{
"name": "https://github.com/metabase/metabase/releases/tag/v0.59.12.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/metabase/metabase/releases/tag/v0.59.12.1"
},
{
"name": "https://github.com/metabase/metabase/releases/tag/v0.60.8.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/metabase/metabase/releases/tag/v0.60.8.1"
},
{
"name": "https://github.com/metabase/metabase/releases/tag/v0.61.3.4",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/metabase/metabase/releases/tag/v0.61.3.4"
}
],
"source": {
"advisory": "GHSA-cwxq-fmxq-jv8h",
"discovery": "UNKNOWN"
},
"title": "Metabase: Arbitrary File Read/Write via Unsafe H2 Built-in Functions"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-103928",
"datePublished": "2026-10-13T15:44:37.906Z",
"dateReserved": "2026-10-01T14:20:19.155Z",
"dateUpdated": "2026-10-13T16:08:31.731Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"vulnrichment": {
"containers": "{\"cna\": {\"title\": \"Metabase: Arbitrary File Read/Write via Unsafe H2 Built-in Functions\", \"problemTypes\": [{\"descriptions\": [{\"cweId\": \"CWE-73\", \"lang\": \"en\", \"description\": \"CWE-73: External Control of File Name or Path\", \"type\": \"CWE\"}]}], \"metrics\": [{\"cvssV4_0\": {\"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"attackRequirements\": \"NONE\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"NONE\", \"vulnConfidentialityImpact\": \"HIGH\", \"vulnIntegrityImpact\": \"HIGH\", \"vulnAvailabilityImpact\": \"NONE\", \"subConfidentialityImpact\": \"NONE\", \"subIntegrityImpact\": \"NONE\", \"subAvailabilityImpact\": \"NONE\", \"baseScore\": 9.3, \"baseSeverity\": \"CRITICAL\", \"vectorString\": \"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N\", \"version\": \"4.0\"}}], \"references\": [{\"name\": \"https://github.com/metabase/metabase/security/advisories/GHSA-cwxq-fmxq-jv8h\", \"tags\": [\"x_refsource_CONFIRM\"], \"url\": \"https://github.com/metabase/metabase/security/advisories/GHSA-cwxq-fmxq-jv8h\"}, {\"name\": \"https://github.com/metabase/metabase/commit/8fb4f0c8a22f195390b4a1d8f5c21db695ae8cc3\", \"tags\": [\"x_refsource_MISC\"], \"url\": \"https://github.com/metabase/metabase/commit/8fb4f0c8a22f195390b4a1d8f5c21db695ae8cc3\"}, {\"name\": \"https://github.com/metabase/metabase/commit/a943448e90e23dbb78001ddedbb15e9c0794473c\", \"tags\": [\"x_refsource_MISC\"], \"url\": \"https://github.com/metabase/metabase/commit/a943448e90e23dbb78001ddedbb15e9c0794473c\"}, {\"name\": \"https://github.com/metabase/metabase/commit/abf3fb8427eccefd8d46149cdebe38f3b49f964f\", \"tags\": [\"x_refsource_MISC\"], \"url\": \"https://github.com/metabase/metabase/commit/abf3fb8427eccefd8d46149cdebe38f3b49f964f\"}, {\"name\": \"https://github.com/metabase/metabase/commit/ae60d1cd156d097f084af43a536b3ab60510c9a4\", \"tags\": [\"x_refsource_MISC\"], \"url\": \"https://github.com/metabase/metabase/commit/ae60d1cd156d097f084af43a536b3ab60510c9a4\"}, {\"name\": \"https://github.com/metabase/metabase/commit/e231432adcc813a75f3ca4832818bda2d9d265da\", \"tags\": [\"x_refsource_MISC\"], \"url\": \"https://github.com/metabase/metabase/commit/e231432adcc813a75f3ca4832818bda2d9d265da\"}, {\"name\": \"https://github.com/metabase/metabase/releases/tag/v0.58.15.3\", \"tags\": [\"x_refsource_MISC\"], \"url\": \"https://github.com/metabase/metabase/releases/tag/v0.58.15.3\"}, {\"name\": \"https://github.com/metabase/metabase/releases/tag/v0.59.12.1\", \"tags\": [\"x_refsource_MISC\"], \"url\": \"https://github.com/metabase/metabase/releases/tag/v0.59.12.1\"}, {\"name\": \"https://github.com/metabase/metabase/releases/tag/v0.60.8.1\", \"tags\": [\"x_refsource_MISC\"], \"url\": \"https://github.com/metabase/metabase/releases/tag/v0.60.8.1\"}, {\"name\": \"https://github.com/metabase/metabase/releases/tag/v0.61.3.4\", \"tags\": [\"x_refsource_MISC\"], \"url\": \"https://github.com/metabase/metabase/releases/tag/v0.61.3.4\"}], \"affected\": [{\"vendor\": \"metabase\", \"product\": \"metabase\", \"versions\": [{\"version\": \"\u003e= 1.55.0, \u003c 1.58.16\", \"status\": \"affected\"}, {\"version\": \"\u003e= 1.59.0, \u003c 1.59.13\", \"status\": \"affected\"}, {\"version\": \"\u003e= 1.60.0, \u003c 1.60.9\", \"status\": \"affected\"}, {\"version\": \"\u003e= 1.61.0, \u003c 1.61.4\", \"status\": \"affected\"}, {\"version\": \"\u003e= 0.55.0, \u003c 0.58.15.3\", \"status\": \"affected\"}, {\"version\": \"\u003e= 0.59.0, \u003c 0.59.12.1\", \"status\": \"affected\"}, {\"version\": \"\u003e= 0.60.0, \u003c 0.60.8.1\", \"status\": \"affected\"}, {\"version\": \"\u003e= 0.61.0, \u003c 0.61.3.4\", \"status\": \"affected\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2026-10-13T15:44:37.906Z\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"Metabase is an open source business intelligence and analytics platform. From 1.55.0 until 1.58.16, 1.59.13, 1.60.9, and 1.61.4, native queries and actions against an H2 data source are passed through without restricting host-facing built-in functions. A user authorized to run native queries or actions can invoke FILE_READ, FILE_WRITE, CSVREAD, CSVWRITE, or LINK_SCHEMA to read or write arbitrary files on the Metabase server or link other databases. The default sample database uses H2, so the vulnerable surface is exposed by default. This issue is fixed in versions 1.58.16, 1.59.13, 1.60.9, and 1.61.4.\"}], \"source\": {\"advisory\": \"GHSA-cwxq-fmxq-jv8h\", \"discovery\": \"UNKNOWN\"}}, \"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-103928\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-10-13T16:08:17.357818Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-10-13T16:08:21.824Z\"}}]}",
"cveMetadata": "{\"cveId\": \"CVE-2026-103928\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"state\": \"PUBLISHED\", \"assignerShortName\": \"GitHub_M\", \"dateReserved\": \"2026-10-01T14:20:19.155Z\", \"datePublished\": \"2026-10-13T15:44:37.906Z\", \"dateUpdated\": \"2026-10-13T16:08:31.731Z\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…