CVE-2026-27005

CRITICAL

9.8

Description

Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to version 4.8.3, an unauthenticated attacker can inject arbitrary SQL into queries executed against databases connected to Chartbrew (MySQL, PostgreSQL). This allows reading, modifying, or deleting data in those databases depending on the database user's privileges. This issue has been patched in version 4.8.3.

CVE Details

CVSS v3.1 Score9.8

SeverityCRITICAL

CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack VectorNETWORK

ComplexityLOW

Privileges RequiredNONE

User InteractionNONE

Published3/6/2026

Last Modified3/10/2026

Sourcenvd

Honeypot Sightings0

Affected Products

depomo:chartbrew

Weaknesses (CWE)

CWE-89

References

https://github.com/chartbrew/chartbrew/releases/tag/v4.8.3(security-advisories@github.com)

https://github.com/chartbrew/chartbrew/security/advisories/GHSA-w5rh-v333-qq6c(security-advisories@github.com)

IOC Correlations

No correlations recorded

This product uses data from the NVD API but is not endorsed or certified by the NVD.