CVE Explorer
CVE-2026-50147
Metabase is an open-source business intelligence and embedded analytics tool. From 1.57.0 until 1.57.19.1, 1.58.14.1, 1.59.10, and 1.60.4, an attacker who can configure a Metabase database connection can read arbitrary files from the Metabase server's filesystem by adding unsafe JDBC parameters to a MySQL or MariaDB connection, causing the driver to read files from the Metabase host and expose the contents through queries against the connected database or through validation error messages. This
Known exploited
Not asserted
Disputed
No
Stale source
No
Conflicts
0
Affected products and versions
1 source assertion{"product":"metabase","vendor":"metabase","versions":[{"status":"affected","version":">= 1.57.0, < 1.57.19.1"},{"status":"affected","version":">= 1.58.0, < 1.58.14.1"},{"status":"affected","version":">= 1.59.0, < 1.59.10"},{"status":"affected","version":">= 1.60.0, < 1.60.4"}]}
- cve_program_cvelist_v5affectedurn:baitaphish:normalized-source-record:v2:cf7db104d71591ac03f69c263d9baed29934ac84ac93556b3e3d944050bb101e · sha256:cf9f374cfe8c1b2c… · /containers/cna/affected/0
Provider-owned CVSS observations
1 source assertion{"metric":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.6,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"LOW","privilegesRequired":"HIGH","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:N","version":"3.1"},"metric_type":"cvssV3_1"}
- cve_program_cvelist_v5cvssurn:baitaphish:normalized-source-record:v2:cf7db104d71591ac03f69c263d9baed29934ac84ac93556b3e3d944050bb101e · sha256:cf9f374cfe8c1b2c… · /containers/cna/metrics/0/cvssV3_1
CWE assertions
1 source assertion{"cweId":"CWE-88","description":"CWE-88: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')","lang":"en","type":"CWE"}
- cve_program_cvelist_v5cweurn:baitaphish:normalized-source-record:v2:cf7db104d71591ac03f69c263d9baed29934ac84ac93556b3e3d944050bb101e · sha256:cf9f374cfe8c1b2c… · /containers/cna/problemTypes/0/descriptions/0
Source references
1 source assertion{"name":"https://github.com/metabase/metabase/security/advisories/GHSA-mfpj-crjq-xrcp","tags":["x_refsource_CONFIRM"],"url":"https://github.com/metabase/metabase/security/advisories/GHSA-mfpj-crjq-xrcp"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:cf7db104d71591ac03f69c263d9baed29934ac84ac93556b3e3d944050bb101e · sha256:cf9f374cfe8c1b2c… · /containers/cna/references/0
Attribution and limitations
- CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →
Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.