CVE-2025-30371

LowCVSS 2.1/10Last modified Jun 17, 2026

Description

Metabase is a business intelligence and embedded analytics tool. Versions prior to v0.52.16.4, v1.52.16.4, v0.53.8, and v1.53.8 are vulnerable to circumvention of local link access protection in GeoJson endpoint. Self hosted Metabase instances that are using the GeoJson feature could be potentially impacted if their Metabase is colocated with other unsecured resources. This is fixed in v0.52.16.4, v1.52.16.4, v0.53.8, and v1.53.8. Migrating to Metabase Cloud or redeploying Metabase in a dedicated subnet with strict outbound port controls is an available workaround.

Metrics

CVSS 4.0 2.1/10CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-59

Affected software

No affected versions have been published.

Timeline

Published
Mar 28, 2025
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2025

CVE-2025-303729.8Emlog is an open source website building system. Emlog Pro versions pro-2.5.7 and pro-2.5.8 contain an SQL injection vulnerability. `search_CVE-2025-303735.3Graylog is a free and open log management platform. Starting with 6.1, HTTP Inputs can be configured to check if a specified header is preseCVE-2025-303757.8Access of resource using incompatible type ('type confusion') in Microsoft Office Excel allows an unauthorized attacker to execute code locaCVE-2025-303767.8Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.CVE-2025-303777.8Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.CVE-2025-303787.0Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code locally.CVE-2025-303797.8Release of invalid pointer or reference in Microsoft Office Excel allows an unauthorized attacker to execute code locally.CVE-2025-30388.8A vulnerability was found in code-projects Payroll Management System 1.0 and classified as critical. This issue affects some unknown processCVE-2025-303817.8Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to execute code locally.CVE-2025-303827.8Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code locally.CVE-2025-303837.8Access of resource using incompatible type ('type confusion') in Microsoft Office Excel allows an unauthorized attacker to execute code locaCVE-2025-303847.0Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code locally.
CVE-2025-30371: Low severity, CVSS 2.1 | Vulnix