CVE-2025-30371 - CVE House
Back to Database
Status published Low CVE-2025-30371

Metabase vulnerable to circumvention of local link access protection in GeoJson endpoint

Vulnerability Description

Metabase is a business intelligence and embedded analytics tool. Versions prior to v0.52.16.4, v1.52.16.4, v0.53.8, and v1.53.8 are vulnerable to circumvention of local link access protection in GeoJson endpoint. Self hosted Metabase instances that are using the GeoJson feature could be potentially impacted if their Metabase is colocated with other unsecured resources. This is fixed in v0.52.16.4, v1.52.16.4, v0.53.8, and v1.53.8. Migrating to Metabase Cloud or redeploying Metabase in a dedicated subnet with strict outbound port controls is an available workaround.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-30371

Credits & Attribution

No credits recorded in the NVD database.

References

More from metabase

View All →
CVE-2025-32382
Snowflake credentials logged by the Metabase backend
Low 1.8
CVE-2025-27141
Metabase Enterprise Edition allows cached questions to leak data to impersonated users
Medium 4.8
CVE-2024-55951
Metabase sandboxed users could see filter values from other sandboxed users
Medium 4.8
CVE-2023-37470
Metabase vulnerable to remote code execution via POST /api/setup/validate API endpoint
Critical 10
CVE-2023-32680
Missing SQL permissions check in metabase
Medium 5.8

Affected Vendor

Affected Software

metabase
Vulnerable Versions:
< 0.52.16.4, < 1.52.16.4, < 0.53.8, < 1.53.8

Timeline

Official Publish: March 28th, 2025
Last Modified: March 28th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

Weaknesses (CWE)

CWE-59

MITRE ATT&CK TTPs

T1574 Hijack Execution Flow
Privilege Escalation
T1222 File and Directory Permissions Modification
Defense Evasion
T1005 Data from Local System
Collection
T1565 Data Manipulation
Impact
T1078 Valid Accounts
Persistence