Path Traversal and File Deletion Vulnerability in Chartbrew Open-Source App

CVE-2026-85736

What is CVE-2026-85736?

Chartbrew, an open-source web application that creates visualizations from databases and APIs, suffers from a vulnerability that allows attackers to manipulate SSL and SSH file paths during connection creation and deletion. When connections are updated or deleted, the application may indiscriminately unlink those paths, leading to potential unauthorized file deletion. This occurs in scenarios where users with specific permissions are able to set malicious paths. Such actions have the potential to compromise sensitive data and disrupt application services. The issue has been addressed in version 5.2.3, which restricts the mishandling of paths during cleanup.

References