---
id: CVE-2026-85736
title: 'Chartbrew: Arbitrary file deletion as root via data connection SSL/SSH paths'
summary: >-
  Chartbrew is an open-source web application that can connect directly to
  databases and APIs and use the data to create charts. Prior to 5.2.3,
  connection creation or update stored attacker-chosen absolute SSL and SSH file
  paths, and late…
severity: high
cvss: 8.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H'
cvssSource: cna
cwe:
  - CWE-73
vendor: chartbrew
product: chartbrew
affected:
  - chartbrew < 5.2.3
published: '2026-11-06'
updated: '2026-11-06'
sourceUpdated: '2026-11-06T21:09:02.969Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-85736'
references:
  - url: >-
      https://github.com/chartbrew/chartbrew/security/advisories/GHSA-p5h6-f969-jpfv
    label: >-
      https://github.com/chartbrew/chartbrew/security/advisories/GHSA-p5h6-f969-jpfv
  - url: >-
      https://github.com/chartbrew/chartbrew/commit/aa931cc868eff8c4343ae2263539fa2d0d4a0943
    label: >-
      https://github.com/chartbrew/chartbrew/commit/aa931cc868eff8c4343ae2263539fa2d0d4a0943
  - url: 'https://github.com/chartbrew/chartbrew/releases/tag/v5.2.3'
    label: 'https://github.com/chartbrew/chartbrew/releases/tag/v5.2.3'
tags:
  - cve.org
ingestedAt: '2026-11-06T22:04:56.325Z'
epss: 0.00202
epssPercentile: 0.10191
---

## Overview

Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to 5.2.3, connection creation or update stored attacker-chosen absolute SSL and SSH file paths, and later connection cleanup passed those stored paths to fs.unlink without a path restriction. The vulnerable surface is data-connection certificate and SSH-key cleanup when a connection is removed. A user with createOwn and deleteOwn permissions on their own team stores a target path in a connection and then deletes the connection to trigger cleanup; default self-signup grants teamOwner these permissions. The cleanup routine treats the stored SSL or SSH path as a managed certificate path and unlinks the referenced file; duplicateConnection provides a second advisory-identified trigger. The attacker must be able to create or update and then delete a connection on their own team. The default container runs Chartbrew as uid 0, while deployments with a less-privileged process are limited by that process's deletion permissions. The attacker can delete files such as /code/.env or application source, causing integrity loss and service disruption. This issue is fixed in version 5.2.3.

## Affected

- `chartbrew < 5.2.3`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.