GeoJSON URL validation can expose server files and environment variables to unauthorized users

{
                    "product": "metabase",
                    "vendor": "metabase",
                    "versions": [
                        {
                            "status": "affected",
                            "version": "< 0.40.5"
                        },
                        {
                            "status": "affected",
                            "version": ">= 1.0.0, < 1.40.5"
                        }
                    ]
                }