CVE-2026-69128 Details
Description
Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. In 5.2.2, the AI SQL blocklist omitted sibling PostgreSQL filesystem functions and failed to match double-quoted identifier forms of denied functions. The vulnerable surface is the AI query tool's PostgreSQL SQL-validation blocklist. A team Owner or Admin uses an AI-enabled PostgreSQL connection whose database role can call server-side file functions and causes generated SQL to use an unlisted sibling function or a double-quoted denied function. Unlisted sibling functions remain allowed, and double-quoted function identifiers bypass the denylist regular expressions and reach PostgreSQL. AI features must be enabled and the user must have elevated Chartbrew privileges. A PostgreSQL superuser or pg_read_server_files role can resolve absolute paths to files readable by the PostgreSQL OS user, while a non-superuser is limited to the source-stated PGDATA-relative scope. This vulnerability is fixed in 5.2.3.
A vulnerability in Chartbrew's AI query tool for PostgreSQL SQL validation has been identified in version 5.2.2. The issue arises from an incomplete blocklist that fails to account for certain PostgreSQL filesystem functions and does not properly match double-quoted identifiers of denied functions. This flaw allows users with elevated privileges to bypass the blocklist and execute unauthorized file access commands. The vulnerability is rooted in the AI orchestrator's SQL blocklist management, which inadequately protects against specific filesystem function calls.
Users are advised to update Chartbrew to version 5.2.3 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Nov 6, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/chartbrew/chartbrew/commit/b83f656a8757beccba461f0f6c5abb1a25dc3b4c | [email protected] | Source CodeVendor |
| https://github.com/chartbrew/chartbrew/releases/tag/v5.2.3 | [email protected] | Release NotesVendor |
| https://github.com/chartbrew/chartbrew/security/advisories/GHSA-jw2r-hrxg-cfgc | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-184 | Incomplete List of Disallowed Inputs | [email protected] |
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Chartbrew | = 5.2.2 (semver) |
CPE
Remediation
| |
Change History
1 change record found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 6, 2026 | New CVE Received | [email protected] |