Metabase is vulnerable when native queries or actions are executed against an H2 data source because the application forwards these queries without restricting H2 built‑in functions, which is a manifestation of CWE-73 (External Control of File Name or Path). An authorized user can invoke FILE_READ, FILE_WRITE, CSVREAD, CSVWRITE, or LINK_SCHEMA, giving the ability to read or write any file on the Metabase server. If an attacker writes an executable or modifies configuration files, this can lead to full remote code execution and compromise the host machine.

The affected product is Metabase as supplied by the Metabase community. Versions 1.55.0 through 1.58.16, 1.59.13, 1.60.9, and 1.61.4 are vulnerable. Because the default sample database uses H2, the vulnerable surface is exposed out of the box unless the sample database is removed or disabled.

The CVSS score is 9.3, indicating critical severity. EPSS is not available, so the likelihood of exploitation cannot be quantified from the public data, but the vulnerability is listed as not in the KEV catalog. The attack vector is inferred: an adversary that has the ability to run native queries or actions—usually via an authenticated account with appropriate privileges—can supply specially crafted H2 statements that call the unsafe functions. Once those statements are executed, the attacker can read or write arbitrary files, potentially executing malicious code on the host system. No exploit code is publicly available, but the vulnerability is technically straightforward for privileged users to exploit.