TI-2026-21991 Aliases CVE-2026-27605

Chartbrew: Stored Cross-Site Scripting (XSS) via File Upload API

LOW 28CWE-434Published 2026-03-06 · Updated 2026-03-06

Key facts

Attack vector: Network
Privileges required: Low
User interaction: Required
Attack complexity: Low
Impact type: Code execution, Cross-site scripting
Confidentiality · integrity · availability: Low · High · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-434 and CWE-79.

Summary

Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to version 4.8.4, the application allows uploading files (project logos) without validating the file type or content. It trusts the extension provided by the user. These files are saved to the uploads/ directory and served statically. An attacker can upload an HTML file containing malicious JavaScript. Since authentication tokens are likely stored in localStorage (as they are returned in the API body), this XSS can lead to account takeover. This issue has been patched in version 4.8.4.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00251 16th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Fixed chartbrew (chartbrew): 4.8.4

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
chartbrew	chartbrew	before 4.8.4	4.8.4	Patch available	CNA

chartbrew Vendorchartbrew Affected before 4.8.4 Fixed in 4.8.4 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:depomo:chartbrew::::::::	before 4.8.4	Vulnerable	chartbrew

cpe:2.3:a:depomo:chartbrew:*:*:*:*:*:*:*:* Versions before 4.8.4 Vulnerable ·chartbrew

Remediation

Fix · CNA chartbrew (chartbrew) Fixed in 4.8.4

Timeline

2026-10-02 Threatist record created from CVE-2026-27605

References

Exploit 1

https://github.com/chartbrew/chartbrew/security/advisories/GHSA-jf6m-hm53-c364

Other 1

https://github.com/chartbrew/chartbrew/releases/tag/v4.8.4

TI-2026-24781 Chartbrew Cross-Tenant Template Export and Secret Disclosure in `GET /team/:team_id/template/generate/:project_id` CVSS 3.1HIGH 7.7
TI-2026-21482 Chartbrew: SQL injection in date-type variable handling (applyMysqlOrPostgresVariables) CVSS 4.0HIGH 8.8
TI-2026-21989 Missing authentication in chartbrew CVSS 4.0HIGH 8.7
TI-2026-20927 Chartbrew: Remote Code Execution (RCE) via Vulnerable API CVSS 3.1HIGH 8.8
TI-2026-23465 Chartbrew has SSRF in API Data Connection - No IP Validation on User-Provided URLs CVSS 4.0HIGH 7.8
TI-2026-20926 Chartbrew: Remote Code Execution (RCE) via MongoDB Dataset Query CVSS 3.1HIGH 7.2

See all 7 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences