CVE-2026-50147

Published: Jul 15, 2026Modified: Jul 30, 2026

7.6

Vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:N

Exploitability: 2.3 / Impact: 4.7

Source: security-advisories@github.com (Secondary)

Description

Metabase is an open-source business intelligence and embedded analytics tool. From 1.57.0 until 1.57.19.1, 1.58.14.1, 1.59.10, and 1.60.4, an attacker who can configure a Metabase database connection can read arbitrary files from the Metabase server's filesystem by adding unsafe JDBC parameters to a MySQL or MariaDB connection, causing the driver to read files from the Metabase host and expose the contents through queries against the connected database or through validation error messages. This issue is fixed in versions 1.57.19.1, 1.58.14.1, 1.59.10, and 1.60.4.

Affected (4)

Products: Metabase: Metabase

Metabase

1 product

Metabase

Configuration A

4 vulnerable

Vulnerable Software	Affected Versions
Metabase Metabase	From 1.57.0 to 1.57.19.1
Metabase Metabase	From 1.58.0 to 1.58.14.1
Metabase Metabase	From 1.59.0 to 1.59.10
Metabase Metabase	From 1.60.0 to 1.60.4

Related CWEs

CWE-88

Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')

The product constructs a string for a command to be executed by a separate component in another control sphere, but it does not properly delimit the intended arguments, options, or switches within that command string.

References (1)

https://github.com/metabase/metabase/security/advisories/GHSA-mfpj-crjq-xrcp

Source: security-advisories@github.com

Vendor Advisory

Timeline

No history available yet.