CVE-2025-30371

Metabase is a business intelligence and embedded analytics tool. Versions prior to v0.52.16.4, v1.52.16.4, v0.53.8, and v1.53.8 are vulnerable to circumvention of local link access protection in GeoJson endpoint. Self hosted Metabase instances that are using the GeoJson feature could be potentially impacted if their Metabase is colocated with other unsecured resources. This is fixed in v0.52.16.4, v1.52.16.4, v0.53.8, and v1.53.8. Migrating to Metabase Cloud or redeploying Metabase in a dedicated subnet with strict outbound port controls is an available workaround.

• CWE-59

• https://github.com/metabase/metabase/security/advisories/GHSA-8xf9-9jc8-qp98

Published

Mar 28, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-30366WeGIA is a Web manager for charitable institutions. Versions…5.4
• CVE-2025-30367WeGIA is a Web manager for charitable institutions. A SQL In…9.8
• CVE-2025-30368Zulip is an open-source team collaboration tool. The API for…2.7
• CVE-2025-30369Zulip is an open-source team collaboration tool. The API for…2.7
• CVE-2025-3037A vulnerability has been found in yzk2356911358 StudentServl…5.3
• CVE-2025-30370jupyterlab-git is a JupyterLab extension for version control…7.4
• CVE-2025-30372Emlog is an open source website building system. Emlog Pro v…9.8
• CVE-2025-30373Graylog is a free and open log management platform. Starting…5.3
• CVE-2025-30375Access of resource using incompatible type ('type confusion'…7.8
• CVE-2025-30376Heap-based buffer overflow in Microsoft Office Excel allows …7.8
• CVE-2025-30377Use after free in Microsoft Office allows an unauthorized at…7.8
• CVE-2025-30378Deserialization of untrusted data in Microsoft Office ShareP…7