PT-2026-32027 · Chartbrew+1 · Chartbrew+1

Razvanilin · Published 2026-04-10 · Updated 2026-04-10 · CVE-2026-30232

Positive Technologies (AI Summary)

CVSS v3.1

9.6

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Chartbrew versions prior to 4.8.5

Description Chartbrew is a web application that connects to databases and APIs to create charts. Before version 4.8.5, authenticated users could create API data connections with arbitrary URLs. The server fetches these URLs using the request-promise library without validating IP addresses, which allows for Server-Side Request Forgery (SSRF) attacks against internal networks and cloud metadata endpoints.

Recommendations Update to version 4.8.5 or later.

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2026-30232

Affected Products

Chartbrew

Request-Promise

References · 5

• https://github.com/chartbrew/chartbrew/security/advisories/GHSA-p4rg-967r-w4cv · Vendor Advisory
• https://github.com/chartbrew/chartbrew/commit/9c4a7e2b02acb25f0782bd4ac1f16407d59c2df1 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-30232 · Security Note
• https://twitter.com/CVEnew/status/2042710186855395641 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2042735888543732063 · Twitter Post