# CVE-2026-103928: Metabase: Arbitrary File Read/Write via Unsafe H2 Built-in Functions

> CVE-2026-103928: Metabase: Arbitrary File Read/Write via Unsafe H2 Built-in Functions. CVSS 9.3 (CVSS 4.0).

Canonical: https://rewindex.com/cve/CVE-2026-103928
Last updated: 2026-10-16T16:00:33Z

- Published: 2026-10-13 15:44 UTC · Updated: 2026-10-16 16:00 UTC · Assigner: GitHub\_M
- CVSS: 9.3 (CVSS 4.0) · Severity: Critical
- EPSS: 0.41%, 35th percentile (scored 2026-10-25)
- CISA KEV: no
- CWE: CWE-73

## Description

Metabase is an open source business intelligence and analytics platform. From 1.55.0 until 1.58.16, 1.59.13, 1.60.9, and 1.61.4, native queries and actions against an H2 data source are passed through without restricting host-facing built-in functions. A user authorized to run native queries or actions can invoke FILE\_READ, FILE\_WRITE, CSVREAD, CSVWRITE, or LINK\_SCHEMA to read or write arbitrary files on the Metabase server or link other databases. The default sample database uses H2, so the vulnerable surface is exposed by default. This issue is fixed in versions 1.58.16, 1.59.13, 1.60.9, and 1.61.4.

## Affected vendors and products

- metabase: metabase

## Tracked companies

- [Metabase](https://rewindex.com/company/metabase.md)
- [Metabase Cloud](https://rewindex.com/company/metabase-cloud.md)

## References

- [CVE record on cve.org](https://www.cve.org/CVERecord?id=CVE-2026-103928)
- [NVD entry](https://nvd.nist.gov/vuln/detail/CVE-2026-103928)
- [https://github.com/metabase/metabase/commit/8fb4f0c8a22f195390b4a1d8f5c21db695ae8cc3](https://github.com/metabase/metabase/commit/8fb4f0c8a22f195390b4a1d8f5c21db695ae8cc3)
- [https://github.com/metabase/metabase/commit/a943448e90e23dbb78001ddedbb15e9c0794473c](https://github.com/metabase/metabase/commit/a943448e90e23dbb78001ddedbb15e9c0794473c)
- [https://github.com/metabase/metabase/commit/abf3fb8427eccefd8d46149cdebe38f3b49f964f](https://github.com/metabase/metabase/commit/abf3fb8427eccefd8d46149cdebe38f3b49f964f)
- [https://github.com/metabase/metabase/commit/ae60d1cd156d097f084af43a536b3ab60510c9a4](https://github.com/metabase/metabase/commit/ae60d1cd156d097f084af43a536b3ab60510c9a4)
- [https://github.com/metabase/metabase/commit/e231432adcc813a75f3ca4832818bda2d9d265da](https://github.com/metabase/metabase/commit/e231432adcc813a75f3ca4832818bda2d9d265da)
- [https://github.com/metabase/metabase/releases/tag/v0.58.15.3](https://github.com/metabase/metabase/releases/tag/v0.58.15.3)
- [https://github.com/metabase/metabase/releases/tag/v0.59.12.1](https://github.com/metabase/metabase/releases/tag/v0.59.12.1)
- [https://github.com/metabase/metabase/releases/tag/v0.60.8.1](https://github.com/metabase/metabase/releases/tag/v0.60.8.1)
- [https://github.com/metabase/metabase/releases/tag/v0.61.3.4](https://github.com/metabase/metabase/releases/tag/v0.61.3.4)
- [https://github.com/metabase/metabase/security/advisories/GHSA-cwxq-fmxq-jv8h](https://github.com/metabase/metabase/security/advisories/GHSA-cwxq-fmxq-jv8h)

---

_Sources: CVE records from the CVE Program (cve.org). CVE® is a registered trademark of The MITRE Corporation. (https://www.cve.org/) This product uses data from the NVD API but is not endorsed or certified by the NVD. (https://nvd.nist.gov/) Known Exploited Vulnerabilities catalog from CISA. (https://www.cisa.gov/known-exploited-vulnerabilities-catalog) EPSS scores from FIRST (Exploit Prediction Scoring System). (https://www.first.org/epss/)_


---
Canonical: https://rewindex.com/cve/CVE-2026-103928 · Markdown: https://rewindex.com/cve/CVE-2026-103928.md · JSON: https://rewindex.com/api/v1/cves/CVE-2026-103928 · Data licensed CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/) · Generated 2026-10-26T03:13:34.420Z