CVE-2022-24854

Metabase is an open source business intelligence and analytics application. SQLite has an FDW-like feature called `ATTACH DATABASE`, which allows connecting multiple SQLite databases via the initial connection. If the attacker has SQL permissions to at least one SQLite database, then it can attach this database to a second database, and then it can query across all the tables. To be able to do that the attacker also needs to know the file path to the second database. Users are advised to upgrade as soon as possible. If you're unable to upgrade, you can modify your SQLIte connection strings to contain the url argument `?limit_attached=0`, which will disallow making connections to other SQLite databases. Only users making use of SQLite are affected.

• CWE-610

• https://github.com/metabase/metabase/security/advisories/GHSA-vm79-xvmp-7329Release Notes, Third Party Advisory
• https://www.sqlite.org/lang_attach.htmlThird Party Advisory
• https://github.com/metabase/metabase/security/advisories/GHSA-vm79-xvmp-7329Release Notes, Third Party Advisory
• https://www.sqlite.org/lang_attach.htmlThird Party Advisory

Published

Apr 14, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-24848DHIS2 is an information system for data capture, management,…8.8
• CVE-2022-24849DisCatSharp is a Discord API wrapper for .NET. Users of vers…6.5
• CVE-2022-2485Any attempt (good or bad) to log into AutomationDirect Strid…7.5
• CVE-2022-24850Discourse is an open source platform for community discussio…4.3
• CVE-2022-24851LDAP Account Manager (LAM) is an open source web frontend fo…4.8
• CVE-2022-24853Metabase is an open source business intelligence and analyti…5.3
• CVE-2022-24855Metabase is an open source business intelligence and analyti…5.4
• CVE-2022-24856FlyteConsole is the web user interface for the Flyte platfor…7.5
• CVE-2022-24857django-mfa3 is a library that implements multi factor authen…8.8
• CVE-2022-24858next-auth v3 users before version 3.29.2 are impacted. next-…6.1
• CVE-2022-24859PyPDF2 is an open source python PDF library capable of split…5.5
• CVE-2022-2486A vulnerability, which was classified as critical, was found…9.8