SQL Injection in Chartbrew Web Application by Chartbrew
CVE-2026-61852

5.8MEDIUM

Key Information:

Vendor

Chartbrew

Status
Chartbrew
Vendor
CVE Published:
21 September 2026

What is CVE-2026-61852?

Chartbrew, an open-source web application designed to create charts from databases and APIs, contains a vulnerability in versions before 5.2.2. The issue lies in the runQuery() function, where the row_limit parameter is integrated into a SQL LIMIT clause without necessary validation checks on input types. This oversight allows authenticated users to manipulate the input and execute arbitrary SQL queries on the connected database. Such manipulations can lead to unauthorized data access, modification, and even the execution of OS commands if the database permissions allow it. Users are encouraged to upgrade to version 5.2.2 or later to mitigate this risk.

Affected Version(s)

chartbrew < 5.2.2

References

https://github.com/chartbrew/chartbrew/security/advisorie...
x_refsource_CONFIRM
https://github.com/chartbrew/chartbrew/commit/8c8412edce5...
x_refsource_MISC
https://github.com/chartbrew/chartbrew/releases/tag/v5.2.2
x_refsource_MISC

CVSS V4

Score:
5.8
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.