CVE-2026-27005

Chartbrew: SQL injection in date-type variable handling (applyMysqlOrPostgresVariables)

CVSS 8.8 HIGHEPSS 0.5%CWE-89

Vexday Risk Score

21Baixo

Decisão SSVC (CISA)

Track

Sem sinal de exploração → monitorar

CVSS 8.8EPSS 0.5%KEV nãoPoC —Nuclei —Metasploit —Patch —

Ciclo de vida

06 mar 2026Publicada no NVD

Recomendação: Monitorar — sem sinal de exploração no momento.

Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to version 4.8.3, an unauthenticated attacker can inject arbitrary SQL into queries executed against databases connected to Chartbrew (MySQL, PostgreSQL). This allows reading, modifying, or deleting data in those databases depending on the database user's privileges. This issue has been patched in version 4.8.3.

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:P

Produtos afetados

chartbrew · chartbrew

Quer saber se a sua infraestrutura está exposta a isto?

Falar com a TrueHacking →

Referências

https://github.com/chartbrew/chartbrew/releases/tag/v4.8.3 https://github.com/chartbrew/chartbrew/security/advisories/GHSA-w5rh-v333-qq6c