PT-2026-23638 · Chartbrew · Chartbrew

Q1Uf3Ng · Published 2026-03-06 · Updated 2026-03-25 · CVE-2026-27005

Positive Technologies · (AI Summary)

CVSS v3.1

9.8

Critical

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Chartbrew versions prior to 4.8.3

Description Chartbrew is a web application that connects to databases and APIs to create charts. Prior to version 4.8.3, an unauthenticated attacker can inject arbitrary SQL into queries executed against connected databases, including MySQL and PostgreSQL. This allows an attacker to potentially read, modify, or delete data within those databases, depending on the database user's permissions. The issue is related to the applyMysqlOrPostgresVariables function.

Recommendations Update Chartbrew to version 4.8.3 or later.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2026-27005

GHSA-W5RH-V333-QQ6C

Affected Products

Chartbrew

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27005.json · Exploit
• https://github.com/chartbrew/chartbrew/security/advisories/GHSA-w5rh-v333-qq6c · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-27005 · Security Note
• https://osv.dev/vulnerability/CVE-2026-27005 · Vendor Advisory
• https://github.com/chartbrew/chartbrew/releases/tag/v4.8.3 · Note
• https://twitter.com/dailycve/status/2031394970981003575 · Twitter Post
• https://t.me/CVEtracker/46537 · Telegram Post
• https://twitter.com/cracbot/status/2031686830169759835 · Twitter Post
• https://twitter.com/TheHackerWire/status/2031384568662732916 · Twitter Post
• https://t.me/cveNotify/154906 · Telegram Post
• https://twitter.com/q1uf3ng/status/2036824777642655889 · Twitter Post
• https://t.me/cveNotify/154462 · Telegram Post