Vulnerability Description
Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to version 4.8.4, the application allows uploading files (project logos) without validating the file type or content. It trusts the extension provided by the user. These files are saved to the uploads/ directory and served statically. An attacker can upload an HTML file containing malicious JavaScript. Since authentication tokens are likely stored in localStorage (as they are returned in the API body), this XSS can lead to account takeover. This issue has been patched in version 4.8.4.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Depomo | Chartbrew | < 4.8.4 |
Related Weaknesses (CWE)
References
- https://github.com/chartbrew/chartbrew/releases/tag/v4.8.4Release Notes
- https://github.com/chartbrew/chartbrew/security/advisories/GHSA-jf6m-hm53-c364ExploitVendor Advisory
FAQ
What is CVE-2026-27605?
CVE-2026-27605 is a vulnerability with a CVSS score of 6.3 (MEDIUM). Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to version 4.8.4, the application allows uploading files (project l...
How severe is CVE-2026-27605?
CVE-2026-27605 has been rated MEDIUM with a CVSS base score of 6.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-27605?
Check the references section above for vendor advisories and patch information. Affected products include: Depomo Chartbrew.