PT-2026-23636 · Chartbrew · Chartbrew

Ytlamal · Published 2026-03-06 · Updated 2026-03-14 · CVE-2026-25887

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Chartbrew versions prior to 4.8.1

Description Chartbrew is a web application that connects to databases and APIs to create charts. Versions of the software prior to 4.8.1 contain a remote code execution issue stemming from the MongoDB dataset Query functionality. The issue was addressed with the release of version 4.8.1.

Recommendations Update to version 4.8.1 or later.

Exploit

Fix

RCE

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2026-25887

GHSA-X4R6-PRMW-7WVW

Affected Products

Chartbrew

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25887.json · Exploit
• https://github.com/chartbrew/chartbrew/security/advisories/GHSA-x4r6-prmw-7wvw · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-25887 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-25887 · Security Note
• https://github.com/chartbrew/chartbrew/releases/tag/v4.8.1 · Note
• https://t.me/cveNotify/154904 · Telegram Post
• https://twitter.com/cracbot/status/2031686826575192497 · Twitter Post
• https://twitter.com/r0otk3r/status/2032207807227838934 · Twitter Post
• https://t.me/cveNotify/154460 · Telegram Post
• https://twitter.com/Tlam56211480/status/2032729936331743489 · Twitter Post