CVE-2026-27005: Chartbrew: SQL injection in date-type variable handling (applyMysqlOrPostgresVariables)
Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to version 4.8.3, an unauthenticated attacker can inject arbitrary SQL into queries executed against databases connected to Chartbrew (MySQL, PostgreSQL). This allows reading, modifying, or deleting data in those databases depending on the database user's privileges. This issue has been patched in version 4.8.3.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-27005?
CVE-2026-27005 is classified as a high-severity vulnerability due to its potential for SQL injection, allowing attackers to execute arbitrary SQL commands.
How do I fix CVE-2026-27005?
To mitigate CVE-2026-27005, upgrade Chartbrew to version 4.8.3 or later, which addresses the SQL injection vulnerability.
What type of attack is CVE-2026-27005 associated with?
CVE-2026-27005 is associated with SQL injection attacks, which enable unauthorized SQL queries to be executed by an attacker.
Which versions of Chartbrew are affected by CVE-2026-27005?
Versions of Chartbrew prior to 4.8.3 are affected by CVE-2026-27005 and are vulnerable to SQL injection.
Is authentication required to exploit CVE-2026-27005?
No, CVE-2026-27005 can be exploited by unauthenticated attackers, making it particularly dangerous.