Metabase, an open‑source business intelligence and embedded analytics platform, permits users to configure database connections. In versions 1.57.0 through 1.57.19.1, 1.58.14.1, 1.59.10, and 1.60.4, an attacker who can create or modify a MySQL or MariaDB connection can inject unsafe JDBC parameters into the connection string. The JDBC driver interprets these parameters as file paths, causing it to read arbitrary files from the Metabase host. The contents of those files are then exposed through query results or validation error messages. This flaw, classified under CWE‑88, enables read‑only access to any file that the Metabase process can read.

All installations of Metabase from version 1.57.0 through 1.57.19.1, 1.58.14.1, 1.59.10, or 1.60.4 are affected. The vulnerability is mitigated by upgrading to the fixed releases 1.57.19.1, 1.58.14.1, 1.59.10, or 1.60.4.

The CVSS score of 7.6 signals a high‑severity flaw, but the EPSS score of less than 1 % indicates that exploitation is currently unlikely. The vulnerability is not listed in the CISA KEV catalog. The attack vector can be inferred to be a local configuration privilege: an attacker must be able to add or alter MySQL/MariaDB connections in Metabase. Once that condition is met, the attacker can read any file that the Metabase process is allowed to access, potentially exposing sensitive configuration or source code.