Metabase contains a local file inclusion vulnerability in the custom map support in the API to read GeoJSON formatted data.
Source: NVD ↗ · CISA KEV Catalog ↗