Metabase versions through 0.63.18 do not properly validate the unspecified address 0.0.0.0 in custom GeoJSON URLs. This flaw allows unauthenticated attackers to save malicious GeoJSON entries containing 0.0.0.0 and trigger requests that access loopback services, potentially exposing sensitive data from those services.