{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-85736","assignerOrgId":"a0819718-46f1-4df5-94e2-005712e83aaa","state":"PUBLISHED","assignerShortName":"GitHub_M","dateReserved":"2026-09-04T14:50:16.719Z","datePublished":"2026-11-06T21:09:02.969Z","dateUpdated":"2026-11-06T21:09:02.969Z"},"containers":{"cna":{"title":"Chartbrew: Arbitrary file deletion as root via data connection SSL/SSH paths","problemTypes":[{"descriptions":[{"cweId":"CWE-73","lang":"en","description":"CWE-73: External Control of File Name or Path","type":"CWE"}]}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","version":"3.1"}}],"references":[{"name":"https://github.com/chartbrew/chartbrew/security/advisories/GHSA-p5h6-f969-jpfv","tags":["x_refsource_CONFIRM"],"url":"https://github.com/chartbrew/chartbrew/security/advisories/GHSA-p5h6-f969-jpfv"},{"name":"https://github.com/chartbrew/chartbrew/commit/aa931cc868eff8c4343ae2263539fa2d0d4a0943","tags":["x_refsource_MISC"],"url":"https://github.com/chartbrew/chartbrew/commit/aa931cc868eff8c4343ae2263539fa2d0d4a0943"},{"name":"https://github.com/chartbrew/chartbrew/releases/tag/v5.2.3","tags":["x_refsource_MISC"],"url":"https://github.com/chartbrew/chartbrew/releases/tag/v5.2.3"}],"affected":[{"vendor":"chartbrew","product":"chartbrew","versions":[{"version":"< 5.2.3","status":"affected"}]}],"providerMetadata":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-11-06T21:09:02.969Z"},"descriptions":[{"lang":"en","value":"Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to 5.2.3, connection creation or update stored attacker-chosen absolute SSL and SSH file paths, and later connection cleanup passed those stored paths to fs.unlink without a path restriction. The vulnerable surface is data-connection certificate and SSH-key cleanup when a connection is removed. A user with createOwn and deleteOwn permissions on their own team stores a target path in a connection and then deletes the connection to trigger cleanup; default self-signup grants teamOwner these permissions. The cleanup routine treats the stored SSL or SSH path as a managed certificate path and unlinks the referenced file; duplicateConnection provides a second advisory-identified trigger. The attacker must be able to create or update and then delete a connection on their own team. The default container runs Chartbrew as uid 0, while deployments with a less-privileged process are limited by that process's deletion permissions. The attacker can delete files such as /code/.env or application source, causing integrity loss and service disruption. This issue is fixed in version 5.2.3."}],"source":{"advisory":"GHSA-p5h6-f969-jpfv","discovery":"UNKNOWN"}}}}