{"id":"CVE-2026-103928","published":"2026-10-13T16:17:10Z","modified":"2026-10-16T16:00:33Z","title":"Metabase is an open source business intelligence and analytics platform","vendor":"metabase","product":"metabase","tier":"core","eol":null,"description":{"text":"Metabase is an open source business intelligence and analytics platform. From 1.55.0 until 1.58.16, 1.59.13, 1.60.9, and 1.61.4, native queries and actions against an H2 data source are passed through without restricting host-facing built-in functions. A user authorized to run native queries or actions can invoke FILE_READ, FILE_WRITE, CSVREAD, CSVWRITE, or LINK_SCHEMA to read or write arbitrary files on the Metabase server or link other databases. The default sample database uses H2, so the vulnerable surface is exposed by default. This issue is fixed in versions 1.58.16, 1.59.13, 1.60.9, and 1.61.4.","provenance":"source","from":"NVD"},"summary":{"text":"Metabase's native query and action handling for H2 data sources (versions 1.55.0 through 1.58.16, 1.59.13, 1.60.9, and 1.61.4) fails to restrict host-facing built-in functions such as FILE_READ, FILE_WRITE, CSVREAD, CSVWRITE, and LINK_SCHEMA, which can be abused to read, write, or link files and databases on the server. An attacker who holds permission to run native queries or actions can exploit this to access arbitrary files on the server, and because the default sample database uses H2, the exposure exists out of the box.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T07:19:33Z"},"cvss":{"score":9.3,"severity":"CRITICAL","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","provenance":"source","from":"NVD"},"epss":{"score":0.00407,"percentile":0.34957,"date":"2026-10-31","provenance":"source"},"kev":null,"vulncheckKev":null,"exploited":false,"otx":null,"cwes":[{"id":"CWE-73","name":"External Control of File Name or Path"}],"references":[{"url":"https://github.com/metabase/metabase/commit/8fb4f0c8a22f195390b4a1d8f5c21db695ae8cc3","tags":[]},{"url":"https://github.com/metabase/metabase/commit/a943448e90e23dbb78001ddedbb15e9c0794473c","tags":[]},{"url":"https://github.com/metabase/metabase/commit/abf3fb8427eccefd8d46149cdebe38f3b49f964f","tags":[]},{"url":"https://github.com/metabase/metabase/commit/ae60d1cd156d097f084af43a536b3ab60510c9a4","tags":[]},{"url":"https://github.com/metabase/metabase/commit/e231432adcc813a75f3ca4832818bda2d9d265da","tags":[]},{"url":"https://github.com/metabase/metabase/releases/tag/v0.58.15.3","tags":[]},{"url":"https://github.com/metabase/metabase/releases/tag/v0.59.12.1","tags":[]},{"url":"https://github.com/metabase/metabase/releases/tag/v0.60.8.1","tags":[]},{"url":"https://github.com/metabase/metabase/releases/tag/v0.61.3.4","tags":[]},{"url":"https://github.com/metabase/metabase/security/advisories/GHSA-cwxq-fmxq-jv8h","tags":[]}],"techniques":[],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2026-98826","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-98826","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":null,"exploitRefs":[],"flow":[],"timeline":[{"date":"2026-10-13","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103928","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":null},"priority":{"score":13.5,"factors":[{"name":"In a KEV catalog","points":0.0,"detail":"not listed"},{"name":"Recent KEV listing","points":0.0,"detail":"not listed"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":6.99,"detail":"percentile 0.3496"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":0.0,"detail":"none found"},{"name":"Mentioned in OTX pulses","points":0.0,"detail":"0 pulses"},{"name":"CVSS severity","points":6.51,"detail":"base score 9.3"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}