CVE-2026-25887

Chartbrew: Remote Code Execution (RCE) via MongoDB Dataset Query

Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to version 4.8.1, there is a remote code execution vulnerability via the MongoDB dataset Query. This issue has been patched in version 4.8.1.

Affected

chartbrew

CVSS v3.1 GITHUB

7.2 HIGHCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

EPSS

0.96% chance of exploitation in the next 30 days, 61st percentile

Published

2026-03-06

Vulhub environments (1)

• vulhub/vulhub/tree/master/chartbrew/CVE-2026-25887

Security advisories

• chartbrew/chartbrew/security/advisories/GHSA-x4r6-prmw-7wvw
• chartbrew/chartbrew/releases/tag/v4.8.1

References

• CVE Record
• NVD entry