---
cve: "CVE-2026-103928"
severity: "CRITICAL"
cvss: 9.3
epss: "0.4%"
vendor: "metabase"
kev: false
exploited: false
published: "2026-10-13 16:17:10"
tags: [cve, security, critical]
source: tsecurity.de CVE-Dossier
exported: "2026-11-10T19:34:16+01:00"
---

# CVE-2026-103928

> 9.3 CRITICAL · 🧪 PoC

## Beschreibung

Metabase is an open source business intelligence and analytics platform. From 1.55.0 until 1.58.16, 1.59.13, 1.60.9, and 1.61.4, native queries and actions against an H2 data source are passed through without restricting host-facing built-in functions. A user authorized to run native queries or actions can invoke FILE_READ, FILE_WRITE, CSVREAD, CSVWRITE, or LINK_SCHEMA to read or write arbitrary files on the Metabase server or link other databases. The default sample database uses H2, so the vulnerable surface is exposed by default. This issue is fixed in versions 1.58.16, 1.59.13, 1.60.9, and 1.61.4.

## CNA-Record (Kanon, cvelistV5)

- CNA: **GitHub_M**
- State: PUBLISHED
- Stand: 2026-10-13 16:08:31
- CNA-CVSS: **9.3** (`CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N`)

## CISA-Anreicherung (vulnrichment/ADP)

- CISA-SSVC (Coordinator, v2.0.3):
  - Exploitation: **none**
  - Automatable: **yes**
  - Technical Impact: **total**

## CVSS-Vektor

```
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
```

| Metrik | Wert | Bewertung |
|---|---|---|
| AV Angriffsvektor | Netzwerk | bad |
| AC Komplexität | Gering | bad |
| PR Privilegien | Keine | bad |
| UI Interaktion | Keine | bad |

## Schwachstellen-Klasse

- **CWE-73** — External Control of File Name or Path
  The product allows user input to control or influence paths or file names that are used in filesystem operations.

## Angriffsmuster (CAPEC)

- [CAPEC-13 — Subverting Environment Variable Values](https://capec.mitre.org/data/definitions/13.html) _(Severity: Very High)_
- [CAPEC-64 — Using Slashes and URL Encoding Combined to Bypass Validation Logic](https://capec.mitre.org/data/definitions/64.html) _(Severity: High)_
- [CAPEC-72 — URL Encoding](https://capec.mitre.org/data/definitions/72.html) _(Severity: High)_
- [CAPEC-76 — Manipulating Web Input to File System Calls](https://capec.mitre.org/data/definitions/76.html) _(Severity: Very High)_
- [CAPEC-78 — Using Escaped Slashes in Alternate Encoding](https://capec.mitre.org/data/definitions/78.html) _(Severity: High)_
- [CAPEC-79 — Using Slashes in Alternate Encoding](https://capec.mitre.org/data/definitions/79.html) _(Severity: High)_
- [CAPEC-80 — Using UTF-8 Encoding to Bypass Validation Logic](https://capec.mitre.org/data/definitions/80.html) _(Severity: High)_
- [CAPEC-267 — Leverage Alternate Encoding](https://capec.mitre.org/data/definitions/267.html) _(Severity: High)_

## ATT&CK-Techniken

- [T1562.003 — Impair Defenses:Impair Command History Logging](https://attack.mitre.org/techniques/T1562/003/)
- [T1574.006 — Hijack Execution Flow:Dynamic Linker Hijacking](https://attack.mitre.org/techniques/T1574/006/)
- [T1574.007 — Hijack Execution Flow:Path Interception by PATH Environment ](https://attack.mitre.org/techniques/T1574/007/)
- [T1027 — Obfuscated Files or Information](https://attack.mitre.org/techniques/T1027/)

## Patch verfügbar (OSV)

- ae60d1cd156d097f084af43a536b3ab60510c9a4 (Commit)
- abf3fb8427eccefd8d46149cdebe38f3b49f964f (Commit)

## Referenzen

- <https://github.com/metabase/metabase/security/advisories/GHSA-cwxq-fmxq-jv8h>
- <https://github.com/metabase/metabase/commit/8fb4f0c8a22f195390b4a1d8f5c21db695ae8cc3>
- <https://github.com/metabase/metabase/commit/a943448e90e23dbb78001ddedbb15e9c0794473c>
- <https://github.com/metabase/metabase/commit/abf3fb8427eccefd8d46149cdebe38f3b49f964f>
- <https://github.com/metabase/metabase/commit/ae60d1cd156d097f084af43a536b3ab60510c9a4>
- <https://github.com/metabase/metabase/commit/e231432adcc813a75f3ca4832818bda2d9d265da>
- <https://github.com/metabase/metabase/releases/tag/v0.58.15.3>
- <https://github.com/metabase/metabase/releases/tag/v0.59.12.1>
- <https://github.com/metabase/metabase/releases/tag/v0.60.8.1>
- <https://github.com/metabase/metabase/releases/tag/v0.61.3.4>

---
_Exportiert aus dem [tsecurity.de CVE-Dossier](https://tsecurity.de/sicherheitsluecken/cve-2026-103928/) · Datenquellen: EUVD (ENISA), NVD, OSV, CISA KEV, FIRST EPSS, Exploit-DB, BSI WID (CSAF)_