CVE-2025-30371: Metabase vulnerable to circumvention of local link access protection in GeoJson endpoint
Metabase is a business intelligence and embedded analytics tool. Versions prior to v0.52.16.4, v1.52.16.4, v0.53.8, and v1.53.8 are vulnerable to circumvention of local link access protection in GeoJson endpoint. Self hosted Metabase instances that are using the GeoJson feature could be potentially impacted if their Metabase is colocated with other unsecured resources. This is fixed in v0.52.16.4, v1.52.16.4, v0.53.8, and v1.53.8. Migrating to Metabase Cloud or redeploying Metabase in a dedicated subnet with strict outbound port controls is an available workaround.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-30371?
CVE-2025-30371 has a medium severity rating, indicating a potential risk for unauthorized access to sensitive data.
How do I fix CVE-2025-30371?
To fix CVE-2025-30371, update your Metabase instance to version 0.52.16.4, 1.52.16.4, 0.53.8, or 1.53.8 or higher.
Who is affected by CVE-2025-30371?
Self-hosted Metabase instances utilizing the GeoJson feature prior to the specified versions are affected by CVE-2025-30371.
What does CVE-2025-30371 exploit?
CVE-2025-30371 exploits the circumvention of local link access protection in the GeoJson endpoint.
Is there a workaround for CVE-2025-30371?
Currently, there is no documented workaround for CVE-2025-30371; upgrading to the patched versions is recommended.