PT-2026-23638 · Chartbrew · Chartbrew

Q1Uf3Ng · Published 2026-03-06 · Updated 2026-03-25 · CVE-2026-27005

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Chartbrew versions prior to 4.8.3

Description Chartbrew is a web application that connects to databases and APIs to create charts. Prior to version 4.8.3, an unauthenticated attacker can inject arbitrary SQL into queries executed against connected databases, specifically MySQL and PostgreSQL. This allows an attacker to potentially read, modify, or delete data within those databases, depending on the privileges of the database user. The vulnerable code involves the handling of date-type variables within the applyMysqlOrPostgresVariables function.

Recommendations Versions prior to 4.8.3 should be updated to version 4.8.3 or later.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2026-27005

GHSA-W5RH-V333-QQ6C

Affected Products

Chartbrew

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27005.json · Exploit
• https://github.com/chartbrew/chartbrew/security/advisories/GHSA-w5rh-v333-qq6c · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-27005 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-27005 · Security Note
• https://github.com/chartbrew/chartbrew/releases/tag/v4.8.3 · Note
• https://twitter.com/dailycve/status/2031394970981003575 · Twitter Post
• https://twitter.com/TheHackerWire/status/2031384568662732916 · Twitter Post
• https://twitter.com/cracbot/status/2031686830169759835 · Twitter Post
• https://twitter.com/q1uf3ng/status/2036824777642655889 · Twitter Post
• https://t.me/cveNotify/154906 · Telegram Post
• https://t.me/CVEtracker/46537 · Telegram Post
• https://t.me/cveNotify/154462 · Telegram Post