CVE-2026-50147

Katalog CVE

CVSS 7.6 · High EPSS 0,34%

Kerentanan Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') pada metabase. Skor CVSS 3.1 7.6 (High) menurut github.com.

Deskripsi (NVD)

Metabase is an open-source business intelligence and embedded analytics tool. From 1.57.0 until 1.57.19.1, 1.58.14.1, 1.59.10, and 1.60.4, an attacker who can configure a Metabase database connection can read arbitrary files from the Metabase server's filesystem by adding unsafe JDBC parameters to a MySQL or MariaDB connection, causing the driver to read files from the Metabase host and expose the contents through queries against the connected database or through validation error messages. This issue is fixed in versions 1.57.19.1, 1.58.14.1, 1.59.10, and 1.60.4.

Rincian

Terbit di NVD

15 Juli 2026

Terakhir diubah

30 Juli 2026

Status NVD

Analyzed

CVSS 3.1

7.6 (High), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-88: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')

EPSS (30 hari)

0,34% peluang dieksploitasi; lebih tinggi dari 25,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/metabase/metabase/security/advisories/GHSA-mfpj-crjq-xrcp advisory vendor