CVE-2026-85736

Name of the Vulnerable Software and Affected Versions Chartbrew versions prior to 5.2.3

Description An issue exists where the application stores attacker-chosen absolute SSL and SSH file paths during connection creation or updates. When a connection is removed or duplicated, the cleanup routine passes these stored paths to the fs.unlink() function without path restrictions. A user with createOwn and deleteOwn permissions can store a target file path in a connection and then delete that connection to trigger the deletion of the referenced file. If the application is running with root privileges (uid 0), an attacker can delete critical files such as /code/.env or application source code, leading to service disruption and loss of integrity.

Recommendations Update to version 5.2.3.