CVE-2026-27005

Chartbrew: SQL injection in date-type variable handling (applyMysqlOrPostgresVariables)

CVSS 8.8 HIGHEPSS 0.5%CWE-89

Vexday Risk Score

21Low

SSVC decision (CISA)

Track

No exploitation signal → monitor

CVSS 8.8EPSS 0.5%KEV nãoPoC —Nuclei —Metasploit —Patch —

Lifecycle

06 Mar 2026Published on NVD

Recommendation: Monitor — no exploitation signal at the moment.

Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to version 4.8.3, an unauthenticated attacker can inject arbitrary SQL into queries executed against databases connected to Chartbrew (MySQL, PostgreSQL). This allows reading, modifying, or deleting data in those databases depending on the database user's privileges. This issue has been patched in version 4.8.3.

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:P

Affected products

chartbrew · chartbrew

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

https://github.com/chartbrew/chartbrew/releases/tag/v4.8.3 https://github.com/chartbrew/chartbrew/security/advisories/GHSA-w5rh-v333-qq6c