Chartbrew, an open‑source dashboard application, has a critical SQL injection flaw in its dashboard‑variable substitution logic. The vulnerability allows an unauthenticated attacker to inject arbitrary SQL through crafted URL filter values that are substituted into stored queries. This oversight, classified as CWE-89, lets a user read, modify or delete data accessible to the database account used by the application.

All Chartbrew installations running a version earlier than 5.2.1 that expose public or embedded dashboards with URL‑controlled variables in a SQL query are vulnerable. The flaw applies to any database connector, and an additional back‑slash escape workaround can also be exploited when the target uses MySQL or MariaDB.

The flaw carries a CVSS score of 9.8, reflecting its high severity. Exploitation is possible over the public web interface without authentication, making it broadly exploitable. Because the EPSS score is not available, the precise current attack frequency is unclear, and the vulnerability is not listed in the CISA KEV catalog. The attacker can execute the injected SQL independently of the underlying database engine, and when targeting MySQL or MariaDB the back‑slash handling offers an alternative path for injection.