CVE-2026-27605

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-27605", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-02-20T19:43:14.602Z", "datePublished": "2026-03-06T04:08:01.530Z", "dateUpdated": "2026-03-06T16:08:17.112Z"}, "containers": {"cna": {"title": "Chartbrew: Stored Cross-Site Scripting (XSS) via File Upload API", "problemTypes": [{"descriptions": [{"cweId": "CWE-434", "lang": "en", "description": "CWE-434: Unrestricted Upload of File with Dangerous Type", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-79", "lang": "en", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/chartbrew/chartbrew/security/advisories/GHSA-jf6m-hm53-c364", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/chartbrew/chartbrew/security/advisories/GHSA-jf6m-hm53-c364"}, {"name": "https://github.com/chartbrew/chartbrew/releases/tag/v4.8.4", "tags": ["x_refsource_MISC"], "url": "https://github.com/chartbrew/chartbrew/releases/tag/v4.8.4"}], "affected": [{"vendor": "chartbrew", "product": "chartbrew", "versions": [{"version": "< 4.8.4", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-06T04:08:01.530Z"}, "descriptions": [{"lang": "en", "value": "Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to version 4.8.4, the application allows uploading files (project logos) without validating the file type or content. It trusts the extension provided by the user. These files are saved to the uploads/ directory and served statically. An attacker can upload an HTML file containing malicious JavaScript. Since authentication tokens are likely stored in localStorage (as they are returned in the API body), this XSS can lead to account takeover. This issue has been patched in version 4.8.4."}], "source": {"advisory": "GHSA-jf6m-hm53-c364", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-06T15:50:39.580851Z", "id": "CVE-2026-27605", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-06T16:08:17.112Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-27605", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-06T15:50:39.580851Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-06T15:50:40.602Z"}}], "cna": {"title": "Chartbrew: Stored Cross-Site Scripting (XSS) via File Upload API", "source": {"advisory": "GHSA-jf6m-hm53-c364", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "chartbrew", "product": "chartbrew", "versions": [{"status": "affected", "version": "< 4.8.4"}]}], "references": [{"url": "https://github.com/chartbrew/chartbrew/security/advisories/GHSA-jf6m-hm53-c364", "name": "https://github.com/chartbrew/chartbrew/security/advisories/GHSA-jf6m-hm53-c364", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/chartbrew/chartbrew/releases/tag/v4.8.4", "name": "https://github.com/chartbrew/chartbrew/releases/tag/v4.8.4", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to version 4.8.4, the application allows uploading files (project logos) without validating the file type or content. It trusts the extension provided by the user. These files are saved to the uploads/ directory and served statically. An attacker can upload an HTML file containing malicious JavaScript. Since authentication tokens are likely stored in localStorage (as they are returned in the API body), this XSS can lead to account takeover. This issue has been patched in version 4.8.4."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-434", "description": "CWE-434: Unrestricted Upload of File with Dangerous Type"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-06T04:08:01.530Z"}}}, "cveMetadata": {"cveId": "CVE-2026-27605", "state": "PUBLISHED", "dateUpdated": "2026-03-06T16:08:17.112Z", "dateReserved": "2026-02-20T19:43:14.602Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-03-06T04:08:01.530Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "chartbrew", "vendor": "chartbrew", "versions": [{"status": "affected", "version": "< 4.8.4"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:depomo:chartbrew:*:*:*:*:*:*:*:*", "matchCriteriaId": "C3C24A0D-9049-4B99-930F-20EE11FFE27F", "versionEndExcluding": "4.8.4", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to version 4.8.4, the application allows uploading files (project logos) without validating the file type or content. It trusts the extension provided by the user. These files are saved to the uploads/ directory and served statically. An attacker can upload an HTML file containing malicious JavaScript. Since authentication tokens are likely stored in localStorage (as they are returned in the API body), this XSS can lead to account takeover. This issue has been patched in version 4.8.4."}, {"lang": "es", "value": "Chartbrew es una aplicaci\u00f3n web de c\u00f3digo abierto que puede conectarse directamente a bases de datos y APIs y usar los datos para crear gr\u00e1ficos. Antes de la versi\u00f3n 4.8.4, la aplicaci\u00f3n permite subir archivos (logotipos de proyectos) sin validar el tipo o el contenido del archivo. Conf\u00eda en la extensi\u00f3n proporcionada por el usuario. Estos archivos se guardan en el directorio uploads/ y se sirven de forma est\u00e1tica. Un atacante puede subir un archivo HTML que contenga JavaScript malicioso. Dado que los tokens de autenticaci\u00f3n probablemente se almacenan en localStorage (ya que se devuelven en el cuerpo de la API), este XSS puede llevar a la toma de control de la cuenta. Este problema ha sido parcheado en la versi\u00f3n 4.8.4."}], "id": "CVE-2026-27605", "lastModified": "2026-06-17T10:27:22.790", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.1, "impactScore": 4.2, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-27605", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-06T15:50:39.580851Z", "version": "2.0.3"}}]}, "published": "2026-03-06T05:16:31.243", "references": [{"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://github.com/chartbrew/chartbrew/releases/tag/v4.8.4"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/chartbrew/chartbrew/security/advisories/GHSA-jf6m-hm53-c364"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}, {"lang": "en", "value": "CWE-434"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,4.8.4)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "chartbrew", "source": "cna", "vendor": "chartbrew"}, "product": "chartbrew", "vendor": "chartbrew"}], "analysis": {"en": {"generated_at": "2026-04-17T12:25:58.543755+00:00", "value": {"mitigation_remediation": ["Apply the vendor patch or upgrade to Chartbrew version 4.8.4 or later, which validates uploaded file types.", "If an upgrade is not immediately feasible, configure the server to reject uploads that are not legitimate image MIME types (e.g., image/png, image/jpeg) and validate the file\u2019s content before saving.", "Move or remove the shared uploads directory from the static public path, serving files through a controlled endpoint that sanitizes output or sets proper content\u2011disposition headers."], "summary": {"action": "Patch Immediately", "impact": "Stored Cross\u2011Site Scripting that enables account takeover by executing arbitrary JavaScript in a user\u2019s browser"}, "threat_synthesis": {"affected_systems": "All installations of Chartbrew built before version 4.8.4 are vulnerable. The issue is fixed in Chartbrew 4.8.4 and later releases.", "description_and_impact": "Chartbrew\u2019s file upload API accepts any file based solely on its extension and stores it in a publicly served uploads directory. The lack of MIME type or content validation permits an attacker to upload an HTML file containing malicious script. When that file is served, the embedded JavaScript runs in the context of the site, potentially accessing authentication tokens stored in localStorage and leading to user account compromise.", "risk_and_exploitability": "The vulnerability carries a CVSS score of 6.3, indicating moderate severity, and an EPSS score of less than 1%, meaning the probability of exploitation is low. It is not listed in the CISA KEV catalog. The likely attack vector is a legitimate API call to the file upload endpoint, where an attacker can supply a crafted HTML file that is subsequently served without filtering, enabling stored XSS."}}}}, "created": "2026-03-06T14:55:56.328693+00:00", "updated": "2026-04-17T12:30:06.269368+00:00", "vendors": ["chartbrew", "chartbrew$PRODUCT$chartbrew"]}