CVE-2026-25887Disclosure(depomo / chartbrew)

LOWCVSS 7.2 · HIGH

Exploit discussion active in current signal (1 latest mentions)

Immediate actions

Patch depomo chartbrew systems immediately
Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft

Recommended action window: High priority (within 72h)

NVD description

Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to version 4.8.1, there is a remote code execution vulnerability via the MongoDB dataset Query. This issue has been patched in version 4.8.1.

depomo CVEs Back to dashboard

2.0/ 10 priority

Sources & remediation

Exploit / PoC references

https://github.com/chartbrew/chartbrew/security/advisories/GHSA-x4r6-prmw-7wvw

Other references

https://github.com/chartbrew/chartbrew/releases/tag/v4.8.1

Weakness type (CWE)

CWE-94

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

chartbrew

Threat summary

Public PoC is present in monitored signal
Patch or workaround signal is available
5 mentions across 5 observed days
Momentum state: stable

What's happening

PoC mentioned or linked in 2 signals
Patch or workaround mentioned in 1 signal
Technical details provided in 4 signals
Disclosure: 3 classified signals
Peaked 4d ago at 1 mentions (2026-03-06); latest day: 1
5 total mentions across 5 days

Affected systems

Vendors

depomo

Products

chartbrew

Deep dive

Activity timeline5 mentions / 5d

Signal classification3 categories

Disclosure

360.0%

Patch

120.0%

PoC

120.0%

Referenced assets3 URLs

By indicator

Classification over time

Date	Total	Labels

2026-03-06	1	Patch1
2026-03-11	1	Disclosure1
2026-03-12	1	Disclosure1
2026-03-14	1	Disclosure1
2026-07-12	1	PoC1

Full discourse5 posts

r0otk3r@r0otk3r90d
PoC
🚨 CVE-2026-25887: Chartbrew RCE via MongoDB Queries 🔗https://www.youtube.com/watch?v=1R_JCGwoYKg #Cybersecurity #Infosec #AppSec #RCE #Chartbrew #CodeInjection #CVE202625887 https://t.co/xvOlRgkdwH
Post summary
The tweet announces CVE‑2026‑25887, a remote code execution flaw in Chartbrew through MongoDB queries, and links to a YouTube video likely demonstrating the vulnerability. No active exploitation or patch information is provided.
0001052
43 followersView on X
Tlam@Tlam56211480210d
Disclosure
I'm happy to share that I discovered 4 CVEs in Chartbrew: • CVE-2026-25887 – RCE via MongoDB Dataset Query • CVE-2026-25888 – RCE via Vulnerable API • CVE-2026-25877 – IDOR in Chart Operations • CVE-2026-27605 – Stored XSS via File Upload API #Chartbrew
Post summary
The author announced the discovery of four new CVEs in Chartbrew, listing each CVE and its associated vulnerability type.
0000037
5 followersView on X
r0otk3r@r0otk3r211d
Disclosure
🚨 CVE-2026-25887: High Severity RCE in Chartbrew via MongoDB Query Injection #CVE202625887 #Chartbrew #PoC #RCE #BugBounty #CyberSecurityNews #MongoDB #NodeJS #InfoSec https://t.co/HQlJMBOA79
Post summary
A new high‑severity RCE vulnerability (CVE‑2026‑25887) has been disclosed in Chartbrew caused by a MongoDB query injection, with a PoC implied via a linked tweet.
00000104
42 followersView on X
CRAC Learning - Tech@cracbot213d
Disclosure
CVE-2026-25887 (CVSS:7.2, HIGH) is Analyzed. Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create c..https://nvd.nist.gov/vuln/detail/CVE-2026-25887 #cybersecurityawareness #cybersecurity #CVE #infosec #hacker #nvd #mitre
Post summary
The tweet announces analysis of CVE-2026-25887, provides its CVSS score and a link to the NVD entry, but does not mention PoC, exploit code, active exploitation, or patches.
0000028
172 followersView on X
CVE@CVEnew217d
Patch
CVE-2026-25887 Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to version 4.8.1, there is a remo… https://www.cve.org/CVERecord?id=CVE-2026-25887
Post summary
CVE-2026-25887 affects Chartbrew and was fixed in version 4.8.1. No proof‑of‑concept, exploit, or active exploitation details are included in the text.
00000129
56.6K followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	depomo	chartbrew	-	-	-

Explore more

Back to dashboard depomo CVEs chartbrew vulnerabilities

What researchers are saying

CVE-2026-25887

r0otk3r@r0otk3rPoC

The tweet announces CVE‑2026‑25887, a remote code execution flaw in Chartbrew through MongoDB queries, and links to a YouTube video likely demonstrating the vulnerability. No active exploitation or patch information is provided.

Tlam@Tlam56211480Disclosure

The author announced the discovery of four new CVEs in Chartbrew, listing each CVE and its associated vulnerability type.

r0otk3r@r0otk3rDisclosure

A new high‑severity RCE vulnerability (CVE‑2026‑25887) has been disclosed in Chartbrew caused by a MongoDB query injection, with a PoC implied via a linked tweet.

CRAC Learning - Tech@cracbotDisclosure

The tweet announces analysis of CVE-2026-25887, provides its CVSS score and a link to the NVD entry, but does not mention PoC, exploit code, active exploitation, or patches.

CVE@CVEnewPatch

CVE-2026-25887 affects Chartbrew and was fixed in version 4.8.1. No proof‑of‑concept, exploit, or active exploitation details are included in the text.