# CVE-2026-50147: Metabase: Arbitrary File Read via MySQL Connection Property Injection

> CVE-2026-50147: Metabase: Arbitrary File Read via MySQL Connection Property Injection. CVSS 7.6 (CVSS 3.1).

Canonical: https://rewindex.com/cve/CVE-2026-50147
Last updated: 2026-07-30T14:30:23Z

- Published: 2026-07-15 15:21 UTC · Updated: 2026-07-30 14:30 UTC · Assigner: GitHub\_M
- CVSS: 7.6 (CVSS 3.1) · Severity: High · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:N
- EPSS: 0.34%, 27th percentile (scored 2026-10-25)
- CISA KEV: no
- CWE: CWE-88

## Description

Metabase is an open-source business intelligence and embedded analytics tool. From 1.57.0 until 1.57.19.1, 1.58.14.1, 1.59.10, and 1.60.4, an attacker who can configure a Metabase database connection can read arbitrary files from the Metabase server's filesystem by adding unsafe JDBC parameters to a MySQL or MariaDB connection, causing the driver to read files from the Metabase host and expose the contents through queries against the connected database or through validation error messages. This issue is fixed in versions 1.57.19.1, 1.58.14.1, 1.59.10, and 1.60.4.

## Affected vendors and products

- metabase: metabase

## Tracked companies

- [Metabase](https://rewindex.com/company/metabase.md)
- [Metabase Cloud](https://rewindex.com/company/metabase-cloud.md)

## References

- [CVE record on cve.org](https://www.cve.org/CVERecord?id=CVE-2026-50147)
- [NVD entry](https://nvd.nist.gov/vuln/detail/CVE-2026-50147)
- [https://github.com/metabase/metabase/security/advisories/GHSA-mfpj-crjq-xrcp](https://github.com/metabase/metabase/security/advisories/GHSA-mfpj-crjq-xrcp)

---

_Sources: CVE records from the CVE Program (cve.org). CVE® is a registered trademark of The MITRE Corporation. (https://www.cve.org/) This product uses data from the NVD API but is not endorsed or certified by the NVD. (https://nvd.nist.gov/) Known Exploited Vulnerabilities catalog from CISA. (https://www.cisa.gov/known-exploited-vulnerabilities-catalog) EPSS scores from FIRST (Exploit Prediction Scoring System). (https://www.first.org/epss/)_


---
Canonical: https://rewindex.com/cve/CVE-2026-50147 · Markdown: https://rewindex.com/cve/CVE-2026-50147.md · JSON: https://rewindex.com/api/v1/cves/CVE-2026-50147 · Data licensed CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/) · Generated 2026-10-26T02:14:40.479Z