Chartbrew is an open‑source web application that can connect directly to databases and APIs to build charts. Until version 5.2.3, a date-typed variable in a MongoDB query that was placed inside a quoted placeholder was inserted without escaping. When a public, shared or embedded chart uses this vulnerable path, an unauthenticated user can provide a crafted URL filter that injects characters to break out of the quoted literal. This turns the query logic into an oracle; the chart's returned row count becomes a Boolean response that can be queried character by character, allowing the attacker to exfiltrate any field in the targeted collection, including secrets that are not shown in the chart.

All public, shared or embedded Chartbrew charts that rely on MongoDB queries with a date variable inside a quoted placeholder, on any Chartbrew release prior to version 5.2.3, are affected. This includes the default installation of Chartbrew where these charts are publicly reachable.

The vulnerability has a CVSS score of 7.5, indicating moderate to high severity. EPSS information is not available, so the exact exploitation probability cannot be quantified, and the issue is not listed in CISA's KEV catalog. The attack does not require authentication, database credentials or prior knowledge of a field value; it only requires an externally reachable, vulnerable chart URL. The blind oracle can extract data from a single queried collection per request, making the risk significant for any sensitive information exposed in those collections.