PT-2026-32027 · Unknown+1 · Request-Promise+1

Razvanilin · CVE-2026-30232 · Published 2026-04-10 · Updated 2026-04-10

Positive Technologies (AI Summary)

CVSS v3.1

9.6

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Chartbrew versions prior to 4.8.5

Description Chartbrew is a web application that connects to databases and APIs to create charts. Before version 4.8.5, authenticated users could create API data connections with arbitrary URLs. The server fetches these URLs using the request-promise library without validating IP addresses, which allows for Server-Side Request Forgery (SSRF) attacks against internal networks and cloud metadata endpoints.

Recommendations Update to version 4.8.5 or later.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2026-30232

GHSA-P4RG-967R-W4CV

Affected Products

Chartbrew

Request-Promise

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/30xxx/CVE-2026-30232.json · Exploit
• https://github.com/chartbrew/chartbrew/commit/9c4a7e2b02acb25f0782bd4ac1f16407d59c2df1 · Patch
• https://github.com/chartbrew/chartbrew/security/advisories/GHSA-p4rg-967r-w4cv · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-30232 · Security Note
• https://osv.dev/vulnerability/CVE-2026-30232 · Vendor Advisory
• https://twitter.com/CVEnew/status/2042710186855395641 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2042735888543732063 · Twitter Post