CVE-2026-27005 Chartbrew: SQL injection in date-type variable handling (applyMysqlOrPostgresVariables)
Unauthenticated attackers can inject SQL into Chartbrew queries, allowing unauthorized reading, modification, or deletion of connected database data.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-27005?
CVE-2026-27005 is a high-severity SQL injection vulnerability in chartbrew, published on 6 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to version 4.8.3, an unauthenticated attacker can inject arbitrary SQL into queries executed against databases connected to Chartbrew (MySQL, PostgreSQL). This allows reading, modifying, or deleting data in those databases depending on the database user's privileges. This issue has been patched in version 4.8.3.
Weakness: CWE-89
Which versions are affected by CVE-2026-27005?
It affects 1 product.
Products include Depomo Chartbrew.
How do I fix CVE-2026-27005?
No fix has been published for CVE-2026-27005 yet. Limit exposure of the affected software until one is available.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is CVE-2026-27005 being exploited?
There is no known exploitation of CVE-2026-27005 in the wild and no public exploit code.
Other vulnerabilities in chartbrew
- CVE-2026-25888 Chartbrew: Remote Code Execution (RCE) via Vulnerable API
- CVE-2026-27603 Missing authorization in chartbrew
- CVE-2026-30232 Chartbrew has SSRF in API Data Connection - No IP Validation on User-Provided URLs
- CVE-2026-32252 Chartbrew Cross-Tenant Template Export and Secret Disclosure in `GET /team/:team_id/template/generate/:project_id`
- CVE-2026-25887 Chartbrew: Remote Code Execution (RCE) via MongoDB Dataset Query
Sources
Also known as GHSA-w5rh-v333-qq6c.