CVE-2026-103928
Metabase is an open source business intelligence and analytics platform. From 1.55.0 until 1.58.16, 1.59.13, 1.60.9, and 1.61.4, native quer
CVSS
—
No CVSS
EPSS
0.4%
p34
KEV
—
Exploit Today
10
0-100
Published: Oct 13, 2026 · Last modified: Oct 16, 2026 · CWE-73
0.4%EPSS · 30 days0.4%
2026-10-142026-10-22
Metabase is an open source business intelligence and analytics platform. From 1.55.0 until 1.58.16, 1.59.13, 1.60.9, and 1.61.4, native queries and actions against an H2 data source are passed through without restricting host-facing built-in functions. A user authorized to run native queries or actions can invoke FILE_READ, FILE_WRITE, CSVREAD, CSVWRITE, or LINK_SCHEMA to read or write arbitrary files on the Metabase server or link other databases. The default sample database uses H2, so the vulnerable surface is exposed by default. This issue is fixed in versions 1.58.16, 1.59.13, 1.60.9, and 1.61.4.
- github.comhttps://github.com/metabase/metabase/commit/8fb4f0c8a22f195390b4a1d8f5c21db695ae8cc3
- github.comhttps://github.com/metabase/metabase/commit/a943448e90e23dbb78001ddedbb15e9c0794473c
- github.comhttps://github.com/metabase/metabase/commit/abf3fb8427eccefd8d46149cdebe38f3b49f964f
- github.comhttps://github.com/metabase/metabase/commit/ae60d1cd156d097f084af43a536b3ab60510c9a4
- github.comhttps://github.com/metabase/metabase/commit/e231432adcc813a75f3ca4832818bda2d9d265da
- github.comhttps://github.com/metabase/metabase/releases/tag/v0.58.15.3
- github.comhttps://github.com/metabase/metabase/releases/tag/v0.59.12.1
- github.comhttps://github.com/metabase/metabase/releases/tag/v0.60.8.1
- github.comhttps://github.com/metabase/metabase/releases/tag/v0.61.3.4
- github.comhttps://github.com/metabase/metabase/security/advisories/GHSA-cwxq-fmxq-jv8h
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-927098.1 HIG—
——0Rsyslog is a rocket-fast system for log processing. From versions 1.15.0 to 8.2610.0, rsyslog's omfile dynaFile facility intentionally allows templates to generate flexible output paths. This supports valid deployments that route logs into different directories or use dynamically generated file names. A deployment becomes unsafe when a dynaFile template uses a value influenced by untrusted input as a path component without explicit secure-path handling. In that configuration, the rendered path can escape the operator's intended log directory. This is not limited to the RFC5424 HOSTNAME field. Any untrusted value that reaches a dynaFile path component can create the condition. At time of publication, there are no publicly available patches.20hCVE-2026-1143795.4 MED18.6%
——6A flaw has been found in EKKOLearnAI ekko-studio up to 1.0.6. This vulnerability affects the function saveGeneratedImages of the file packages/server/src/modules/studio/controllers/media.ts of the component Media Generation API. This manipulation of the argument output_path causes file inclusion. Remote exploitation of the attack is possible. Patch name: 1d42459c292f89e412f7f6243829e7fed2e85bf5. It is recommended to apply a patch to fix this issue.19hCVE-2026-1144915.3 MED16.2%
——5pdfmake 0.3.8 before 0.3.12 fails to apply the setLocalAccessPolicy() restriction to images referenced inside SVG content, allowing attackers to read blocked local files. Attackers supplying a document definition can add an SVG image href pointing to a local path, embedding restricted file contents in the generated PDF.2dCVE-2026-1142536.3 MED24.4%
——7A vulnerability was determined in oretnom23 file-management-system-php up to 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4. The impacted element is the function include of the file index.php. Executing a manipulation of the argument page can lead to file inclusion. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases. The project was informed of the problem early through an issue report but has not responded yet.2dCVE-2026-1123104.3 MED25.6%
——8docling-core 2.5.0 before 2.103.0 contains a local file disclosure vulnerability that allows attackers to read local images by supplying plain filesystem paths in ImageRef URIs, bypassing the allow_image_file_uri gate. Attackers can submit crafted DoclingDocument JSON or YAML that, when exported with ImageRefMode.EMBEDDED or rendered to HTML, embeds readable local image files as base64 and reveals path existence.4dCVE-2026-1119352.6 LOW15.8%
——5NoteGen through 0.38.3 contains an external control of file path vulnerability in chat image analysis that allows attackers to read local image files via unvalidated synced sourceUrl paths. Attackers with write access to the victim's sync target can plant absolute paths or file:// URLs, causing image_inspect to send local images to the AI provider.4d