CVE-2026-103928

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-103928

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-103928.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-103928

Aliases

GHSA-cwxq-fmxq-jv8h

Published

2026-10-13T15:44:37Z

Modified

2026-10-15T02:47:53Z

Severity

9.3 (Critical) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N CVSS Calculator

Summary

Metabase: Arbitrary File Read/Write via Unsafe H2 Built-in Functions

Details

Metabase is an open source business intelligence and analytics platform. From 1.55.0 until 1.58.16, 1.59.13, 1.60.9, and 1.61.4, native queries and actions against an H2 data source are passed through without restricting host-facing built-in functions. A user authorized to run native queries or actions can invoke FILE_READ, FILE_WRITE, CSVREAD, CSVWRITE, or LINK_SCHEMA to read or write arbitrary files on the Metabase server or link other databases. The default sample database uses H2, so the vulnerable surface is exposed by default. This issue is fixed in versions 1.58.16, 1.59.13, 1.60.9, and 1.61.4.

Database specific

{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-73"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/103xxx/CVE-2026-103928.json",
    "unresolved_ranges":  [
        {
            "extracted_events":  [
                {
                    "introduced":  "1.55.0"
                },
                {
                    "fixed":  "1.58.16"
                },
                {
                    "introduced":  "1.59.0"
                },
                {
                    "fixed":  "1.59.13"
                },
                {
                    "introduced":  "1.60.0"
                },
                {
                    "fixed":  "1.60.9"
                },
                {
                    "introduced":  "1.61.0"
                },
                {
                    "fixed":  "1.61.4"
                }
            ],
            "source":  "AFFECTED_FIELD"
        }
    ]
}

References

Affected packages

Git / github.com/metabase/metabase

Affected ranges

Type

GIT

Repo

https://github.com/metabase/metabase

Events

Introduced

25a78a355fa6f04e3ce2029006b24ebe9a02ebcb

Introduced

95d41fa1e4435aa4ff147c4c7cb0d08c2f3b586a

Introduced

cc12039807af543e457938ac5b6fdf7927ae4110

Introduced

d5bb4cce64086bd941b332fbbf7b19e6d02e222c

Fixed

ae60d1cd156d097f084af43a536b3ab60510c9a4

Fixed

abf3fb8427eccefd8d46149cdebe38f3b49f964f

Fixed

e82ba5f1ac349a27771670fdd5f10819548b1328

Fixed

e231432adcc813a75f3ca4832818bda2d9d265da

Fixed

8fb4f0c8a22f195390b4a1d8f5c21db695ae8cc3

Fixed

a943448e90e23dbb78001ddedbb15e9c0794473c

Database specific

Show details

{
    "extracted_events":  [
        {
            "introduced":  "0.55.0"
        },
        {
            "fixed":  "0.58.15.3"
        },
        {
            "introduced":  "0.59.0"
        },
        {
            "fixed":  "0.59.12.1"
        },
        {
            "introduced":  "0.60.0"
        },
        {
            "fixed":  "0.60.8.1"
        },
        {
            "introduced":  "0.61.0"
        },
        {
            "fixed":  "0.61.3.4"
        }
    ],
    "source":  [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

embedding-sdk-0.*

embedding-sdk-0.59.0

embedding-sdk-0.59.0-beta.0

embedding-sdk-0.60.0

embedding-sdk-0.60.0-beta.0

Other

embedding-sdk-59-stable

embedding-sdk-60-stable

v0.*

v0.59.0.1-beta

v0.59.0.2-beta

v0.59.0.3-beta

v0.59.0.4-beta

v0.59.0.5-beta

v0.59.0.6-beta

v0.59.0.7-beta

v0.59.0.x

v0.59.1

v0.59.1.1

v0.59.1.2

v0.59.1.3

v0.59.1.4

v0.59.1.5

v0.59.1.6

v0.59.1.x

v0.59.10

v0.59.10.1

v0.59.10.x

v0.59.11

v0.59.11.x

v0.59.12

v0.59.12.x

v0.59.2

v0.59.2.1

v0.59.2.2

v0.59.2.3

v0.59.2.4

v0.59.2.5

v0.59.2.6

v0.59.2.7

v0.59.2.x

v0.59.3

v0.59.3.1

v0.59.3.2

v0.59.3.x

v0.59.4

v0.59.4.1

v0.59.4.2

v0.59.4.3

v0.59.4.4

v0.59.4.5

v0.59.4.x

v0.59.5

v0.59.5.1

v0.59.5.2

v0.59.5.x

v0.59.6

v0.59.6.1

v0.59.6.2

v0.59.6.3

v0.59.6.4

v0.59.6.5

v0.59.6.x

v0.59.7

v0.59.7.1

v0.59.7.2

v0.59.7.3

v0.59.7.x

v0.59.8

v0.59.8.1

v0.59.8.2

v0.59.8.3

v0.59.8.4

v0.59.8.5

v0.59.8.x

v0.59.9

v0.59.9.1

v0.59.9.x

v0.60.0.3-beta

v0.60.0.4-beta

v0.60.0.5-beta

v0.60.0.6-beta

v0.60.0.7-beta

v0.60.0.8-beta

v0.60.0.x

v0.60.1

v0.60.1.1

v0.60.1.2

v0.60.1.3

v0.60.1.4

v0.60.1.5

v0.60.1.6

v0.60.1.x

v0.60.2

v0.60.2.1

v0.60.2.2

v0.60.2.3

v0.60.2.4

v0.60.2.5

v0.60.2.6

v0.60.2.x

v0.60.3

v0.60.3.1

v0.60.3.2

v0.60.3.3

v0.60.3.4

v0.60.3.5

v0.60.3.6

v0.60.3.7

v0.60.3.8

v0.60.3.x

v0.60.4

v0.60.4.1

v0.60.4.2

v0.60.4.3

v0.60.4.4

v0.60.4.x

v0.60.5

v0.60.5.1

v0.60.5.2

v0.60.5.3

v0.60.5.x

v0.60.6

v0.60.6.1

v0.60.6.2

v0.60.6.3

v0.60.6.x

v0.60.7

v0.60.7.1

v0.60.7.2

v0.60.7.3

v0.60.7.4

v0.60.7.5

v0.60.7.6

v0.60.7.7

v0.60.7.x

v0.60.8

v0.60.8.x

v0.60.x

v0.61.0.10-beta

v0.61.0.8-beta

v0.61.0.9-beta

v0.61.0.x

v0.61.1

v0.61.1.1

v0.61.1.2

v0.61.1.3

v0.61.1.4

v0.61.1.5

v0.61.1.x

v0.61.2

v0.61.2.1

v0.61.2.10

v0.61.2.2

v0.61.2.3

v0.61.2.4

v0.61.2.5

v0.61.2.6

v0.61.2.7

v0.61.2.8

v0.61.2.9

v0.61.2.x

v0.61.3

v0.61.3.1

v0.61.3.2

v0.61.3.3

v0.61.3.x

v0.61.x

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-103928.json"