CVE-2026-27605

Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to version 4.8.4, the application allows uploading files (project logos) without validating the file type or content. It trusts the extension provided by the user. These files are saved to the uploads/ directory and served statically. An attacker can upload an HTML file containing malicious JavaScript. Since authentication tokens are likely stored in localStorage (as they are returned in the API body), this XSS can lead to account takeover. This issue has been patched in version 4.8.4.

CVSS v3 6.3 MEDIUM

6.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.1 / Impact : 4.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/chartbrew/chartbrew/releases/tag/v4.8.4	Release Notes
https://github.com/chartbrew/chartbrew/security/advisories/GHSA-jf6m-hm53-c364	Exploit Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:depomo:chartbrew:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2026-03-06 05:16

Updated : 2026-03-10 14:01

NVD link : CVE-2026-27605

Mitre link : CVE-2026-27605

CVE.ORG link : CVE-2026-27605

JSON object : View

Products Affected

depomo

chartbrew

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CWE-434

Unrestricted Upload of File with Dangerous Type

{"id": "CVE-2026-27605", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 4.2, "exploitabilityScore": 2.1}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.3}]}, "published": "2026-03-06T05:16:31.243", "references": [{"url": "https://github.com/chartbrew/chartbrew/releases/tag/v4.8.4", "tags": ["Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/chartbrew/chartbrew/security/advisories/GHSA-jf6m-hm53-c364", "tags": ["Exploit", "Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-79"}, {"lang": "en", "value": "CWE-434"}]}], "descriptions": [{"lang": "en", "value": "Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to version 4.8.4, the application allows uploading files (project logos) without validating the file type or content. It trusts the extension provided by the user. These files are saved to the uploads/ directory and served statically. An attacker can upload an HTML file containing malicious JavaScript. Since authentication tokens are likely stored in localStorage (as they are returned in the API body), this XSS can lead to account takeover. This issue has been patched in version 4.8.4."}, {"lang": "es", "value": "Chartbrew es una aplicaci\u00f3n web de c\u00f3digo abierto que puede conectarse directamente a bases de datos y APIs y usar los datos para crear gr\u00e1ficos. Antes de la versi\u00f3n 4.8.4, la aplicaci\u00f3n permite subir archivos (logotipos de proyectos) sin validar el tipo o el contenido del archivo. Conf\u00eda en la extensi\u00f3n proporcionada por el usuario. Estos archivos se guardan en el directorio uploads/ y se sirven de forma est\u00e1tica. Un atacante puede subir un archivo HTML que contenga JavaScript malicioso. Dado que los tokens de autenticaci\u00f3n probablemente se almacenan en localStorage (ya que se devuelven en el cuerpo de la API), este XSS puede llevar a la toma de control de la cuenta. Este problema ha sido parcheado en la versi\u00f3n 4.8.4."}], "lastModified": "2026-03-10T14:01:09.233", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:depomo:chartbrew:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C3C24A0D-9049-4B99-930F-20EE11FFE27F", "versionEndExcluding": "4.8.4"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}