Executive brief
Chartbrew is an open-source web application that connects to databases and creates visual charts. Prior to version 5.2.3, the ClickHouse integration fails to properly escape backslashes in variable substitution, allowing attackers to break out of SQL string literals and execute arbitrary queries. Public dashboards expose this vulnerability without requiring authentication, potentially enabling data theft or unauthorized file access on the database server.
Technical details
The ClickHouse protocol handler in Chartbrew calls applySqlVariables() without enabling the escapeBackslash option, allowing SQL injection through quote-doubling bypass via backslash prefix. An attacker can supply a backslash before a quote character to escape the quote protection mechanism and inject arbitrary SQL. Public dashboards without authentication requirements provide the attack vector; successful exploitation allows arbitrary ClickHouse SQL execution with potential for data disclosure or file system access depending on database permissions.
Affected products
- Chartbrew Chartbrew before 5.2.3
Timeline
- 2026-09-21: disclosed
- 2026-07-19: patched