This vulnerability is a classic SQL injection flaw in the date‑type variable handling within the applyMysqlOrPostgresVariables function. An attacker can input unsanitized variables that are directly interpolated into dynamic queries, allowing the execution of arbitrary SQL. Depending on the privileges of the database user configured in Chartbrew, the attacker could read sensitive data, modify records, or delete entire tables, compromising confidentiality, integrity, and availability.

All deployments of Chartbrew running any release earlier than v4.8.3 are affected. Versions 4.8.3 and later contain the fix and are therefore not vulnerable.

The CVSS score of 8.8 indicates a high severity, reflecting the potential for an attacker to gain elevated database privileges or compromise data integrity. The EPSS score of less than 1 % suggests that exploitation is currently uncommon, yet the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is remote, as the flaw can be triggered by unauthenticated actors submitting unsanitized input to the application. An attacker who exploits this flaw can execute arbitrary SQL against any database that Chartbrew connects to, leading to data disclosure, modification, or deletion.