CVE-2026-25888

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to version 4.8.1, there is a remote code execution vulnerability via a vulnerable API. This issue has been patched in version 4.8.1.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-94

Affected software

Vendor	Product	Versions
chartbrew	chartbrew	< 4.8.1

References

https://github.com/chartbrew/chartbrew/releases/tag/v4.8.1Release Notes
https://github.com/chartbrew/chartbrew/security/advisories/GHSA-875w-45c2-gxq8Exploit, Vendor Advisory

Timeline

Published: Mar 6, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-258895.4File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit CVE-2026-25895.3The Greenshift – animation and page builder blocks plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up t CVE-2026-258908.1File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit CVE-2026-258917.5Fiber is an Express inspired web framework written in Go. A Path Traversal (CWE-22) vulnerability in Fiber allows a remote attacker to bypas CVE-2026-258927.5Adminer is open-source database management software. Adminer v5.4.1 and earlier has a version check mechanism where adminer.org sends signed CVE-2026-258939.8FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. Prior to 1.2.10, an authentication bypass vulnerability in FUXA al CVE-2026-258949.8FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. An insecure default configuration in FUXA allows an unauthenticate CVE-2026-258959.8FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. A path traversal vulnerability in FUXA allows an unauthenticated, CVE-2026-258969.3fast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from JS object without C/C++ based libraries and no callb CVE-2026-258979.8ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, an CVE-2026-258989.1ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, the CVE-2026-258997.5Fiber is an Express inspired web framework written in Go. In versions on the v3 branch prior to 3.1.0, the use of the `fiber_flash` cookie c