Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to version 4.8.1, there is a remote code execution vulnerability via a vulnerable API. This issue has been patched in version 4.8.1.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-03-06 | 3 | Disclosure1Patch2 |
| 2026-03-10 | 1 | Disclosure1 |
| 2026-03-11 | 1 | General1 |
| 2026-03-14 | 1 | Disclosure1 |
I'm happy to share that I discovered 4 CVEs in Chartbrew: • CVE-2026-25887 – RCE via MongoDB Dataset Query • CVE-2026-25888 – RCE via Vulnerable API • CVE-2026-25877 – IDOR in Chart Operations • CVE-2026-27605 – Stored XSS via File Upload API #Chartbrew
Post summary
The author announces discovery of four new CVEs in Chartbrew, specifying their types (RCE, IDOR, XSS) but provides no PoC, exploit, or patch details.
CVE-2026-25888 (CVSS:8.8, HIGH) is Analyzed. Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create c..https://nvd.nist.gov/vuln/detail/CVE-2026-25888 #cybersecurityawareness #cybersecurity #CVE #infosec #hacker #nvd #mitre
Post summary
The post provides a brief disclosure of CVE-2026-25888, noting its CVSS score and affected product, but lacks any PoC, exploit details, active exploitation evidence, or patches.
🔴 Chartbrew Remote Code Execution (#CVE-2026-25888) (High) https://dailycve.com/chartbrew-remote-code-execution-cve-2026-25888-high/
Post summary
The post announces the discovery of CVE-2026-25888, a high‑severity remote code execution flaw in Chartbrew, without offering PoC, exploit code, or mitigation details.
CVE-2026-25888 Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to version 4.8.1, there is a remo… https://www.cve.org/CVERecord?id=CVE-2026-25888
Post summary
The post references CVE‑2026‑25888 affecting Chartbrew, noting that a fix exists in version 4.8.1, but provides no concrete proof‑of‑concept, exploit, or detailed technical information.
🟠 CVE-2026-25888 - High Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to version 4.8.1, there is a remote code execution vulnera... https://www.thehackerwire.com/vulnerability/CVE-2026-25888/ https://t.co/eTtWAfDkK3
Post summary
The tweet announces a high‑severity remote code execution vulnerability in Chartbrew, but does not provide exploit details, workarounds, or evidence of active exploitation.
[CVE-2026-25888: HIGH] Chartbrew, an open-source app for data visualization, patched a remote code execution vulnerability in version 4.8.1. Ensure you update to secure your data.#cve,CVE-2026-25888,#cybersecurity https://cvefind.com/CVE-2026-25888
Post summary
Chartbrew has patched a remote code execution vulnerability (CVE-2026-25888) in version 4.8.1, and users are advised to update to mitigate the risk.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | depomo | chartbrew | - | - | - |