CVE-2026-85736: Chartbrew: Arbitrary file deletion as root via data connection SSL/SSH paths
Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to 5.2.3, connection creation or update stored attacker-chosen absolute SSL and SSH file paths, and later connection cleanup passed those stored paths to fs.unlink without a path restriction. The vulnerable surface is data-connection certificate and SSH-key cleanup when a connection is removed. A user with createOwn and deleteOwn permissions on their own team stores a target path in a connection and then deletes the connection to trigger cleanup; default self-signup grants teamOwner these permissions. The cleanup routine treats the stored SSL or SSH path as a managed certificate path and unlinks the referenced file; duplicateConnection provides a second advisory-identified trigger. The attacker must be able to create or update and then delete a connection on their own team. The default container runs Chartbrew as uid 0, while deployments with a less-privileged process are limited by that process's deletion permissions. The attacker can delete files such as /code/.env or application source, causing integrity loss and service disruption. This issue is fixed in version 5.2.3.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Chartbrewto a version that resolves this vulnerability.Fixed in 5.2.3
Event History
Frequently Asked Questions
Which users can exploit this issue in a typical deployment?
A user who can create or update a data connection and then delete a connection in their own team can exploit it. Default self-signup grants the teamOwner role, which includes the required createOwn and deleteOwn permissions.
What access or interaction is required to trigger deletion?
The attacker must store an attacker-chosen absolute SSL certificate or SSH key path in a data connection, then remove that connection so its cleanup runs. The advisory also identifies duplicateConnection as a second trigger path.
Are default container deployments especially exposed?
Yes. The default container runs Chartbrew as uid 0, so cleanup can delete files accessible to root, including application files such as /code/.env or source files. Deployments running Chartbrew under a less-privileged account are limited to files that account can delete.
What is the practical impact?
An attacker can cause integrity loss and service disruption by deleting arbitrary files that the Chartbrew process is permitted to remove. The described examples include /code/.env and application source files.
What version addresses the issue?
The issue affects Chartbrew versions prior to 5.2.3. Upgrading to version 5.2.3 removes the affected vulnerable version range described in the advisory.