Chartbrew's AI query tool contains a flaw in the PostgreSQL SQL‑validation blocklist that omits sibling functions such as pg_stat_file and allows double‑quoted identifiers to bypass the denylist. If an owner or admin user enables AI for a PostgreSQL connection whose database role can invoke server‑side file functions, the validator will accept a crafted query that references an unlisted sibling or a double‑quoted function. The resulting SQL is executed with the database role’s privileges, letting the attacker read arbitrary files that the PostgreSQL process can access, such as files within the PGDATA directory or other server‑side paths. This provides a local file‑read vulnerability that can expose configuration files, credentials, or other sensitive data, depending on the PostgreSQL role’s permissions.

Chartbrew versions prior to 5.2.3 are affected, specifically 5.2.2 where the vulnerability exists. The product is chartbrew/chartbrew, an open‑source web application that connects to databases and APIs to build charts. The fix is included in release 5.2.3, which restores the proper denylist checks and removes the ability to use the vulnerable functions via double‑quoted identifiers.

The CVSS score of 4.6 places the vulnerability in the low severity range, and no EPSS score is available for current exploitation data. It is not listed in the CISA KEV catalog. Exploitation requires that AI features be enabled, the user have owner or admin rights in Chartbrew, and the connected PostgreSQL role possess file‑access functionality such as pg_read_server_files or must be a superuser. Once those conditions are met, an attacker can craft a single query that bypasses the blocklist and retrieve arbitrary files. Based on the description, it is inferred that the attack vector requires an attacker who already has Owner or Admin rights within Chartbrew and has access to an AI‑enabled PostgreSQL connection. The lack of publicly documented exploits suggests the threat is limited to environments where the above conditions align.