Yüksek CVSS 8.1
CVE-2026-85736: Chartbrew: Güvenilmeyen Veriyle Dosya Silme Açığı
Chartbrew uygulamasında, kullanıcılar bağlantı silme sırasında sunucudaki rastgele dosyaları silebilir. Saldırganlar kritik konfigürasyon dosyalarını silerek servisi durdurabilir. Hemen 5.2.3 veya üzeri sürüme güncelleyin.
Türkçe özet yapay zekâ ile üretildi.
Açıklama (NVD)
Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to 5.2.3, connection creation or update stored attacker-chosen absolute SSL and SSH file paths, and later connection cleanup passed those stored paths to fs.unlink without a path restriction. The vulnerable surface is data-connection certificate and SSH-key cleanup when a connection is removed. A user with createOwn and deleteOwn permissions on their own team stores a target path in a connection and then deletes the connection to trigger cleanup; default self-signup grants teamOwner these permissions. The cleanup routine treats the stored SSL or SSH path as a managed certificate path and unlinks the referenced file; duplicateConnection provides a second advisory-identified trigger. The attacker must be able to create or update and then delete a connection on their own team. The default container runs Chartbrew as uid 0, while deployments with a less-privileged process are limited by that process's deletion permissions. The attacker can delete files such as /code/.env or application source, causing integrity loss and service disruption. This issue is fixed in version 5.2.3.
Özet bilgiler
- CVSS v3.1
- 8.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H - CWE
- CWE-73
- Yama
- Yok / bilinmiyor