CVE-2026-59109

SQL injection in the Zalktis accounting application via trading-partner-controlled text fields in received electronic invoices. When importing a received e-invoice (UBL/PEPPOL) or an e-commerce export, Zalktis concatenates partner-controlled values directly into SQL statement text using string concatenation, with neither parameterised queries nor escaping. The application's own escaping helper, Dazadi.sql_txt(), is not invoked on these code paths, so a party that sends an invoice can break out of the string literal and alter the query logic. This issue affects Zalktis: before 2026.1.586 and before 2026.2.592.

CVSS v3 8.8 HIGH

8.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://cvd.cert.lv/disclosed/vuln-all-631428755
https://offseq.com/en/research/zalktis-cve-2026-59109
https://offseq.com/en/research/zalktis-cve-2026-59109/

Configurations

No configuration.

History

23 Oct 2026, 18:10

Type	Values Removed	Values Added
Summary		(es) Inyección SQL en la aplicación de contabilidad Zalktis a través de campos de texto controlados por el socio comercial en facturas electrónicas recibidas. Al importar una factura electrónica recibida (UBL/PEPPOL) o una exportación de comercio electrónico, Zalktis concatena valores controlados por el socio directamente en el texto de la sentencia SQL utilizando concatenación de cadenas, sin consultas parametrizadas ni escape. El propio ayudante de escape de la aplicación, Dazadi.sql_txt(), no se invoca en estas rutas de código, por lo que una parte que envía una factura puede salir del literal de cadena y alterar la lógica de la consulta. Este problema afecta a Zalktis: antes de 2026.1.586 y antes de 2026.2.592.

Information

Published : 2026-08-13 17:17

Updated : 2026-10-24 16:10

NVD link : CVE-2026-59109

Mitre link : CVE-2026-59109

CVE.ORG link : CVE-2026-59109

JSON object : View

Products Affected

No product.

CWE

CWE-20

Improper Input Validation

CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

{"id": "CVE-2026-59109", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-59109", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-08-14T17:46:01.133135Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}], "cvssMetricV40": [{"type": "Secondary", "source": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.7, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158", "affectedData": [{"vendor": "Zalktis Programmas (SIA \"Zalktis Programmas\")", "product": "Zalktis", "versions": [{"status": "affected", "version": "0", "lessThan": "2026.1.586", "versionType": "semver"}, {"status": "affected", "version": "0", "lessThan": "2026.2.592", "versionType": "semver"}], "platforms": ["Windows"], "defaultStatus": "unaffected"}]}], "published": "2026-08-13T17:17:29.207", "references": [{"url": "https://cvd.cert.lv/disclosed/vuln-all-631428755", "source": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158"}, {"url": "https://offseq.com/en/research/zalktis-cve-2026-59109", "source": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158"}, {"url": "https://offseq.com/en/research/zalktis-cve-2026-59109/", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158", "description": [{"lang": "en", "value": "CWE-20"}, {"lang": "en", "value": "CWE-89"}]}], "descriptions": [{"lang": "en", "value": "SQL injection in the Zalktis accounting application via\ntrading-partner-controlled text fields in received electronic invoices. When\nimporting a received e-invoice (UBL/PEPPOL) or an e-commerce export, Zalktis\nconcatenates partner-controlled values directly into SQL statement text using\nstring concatenation, with neither parameterised queries nor escaping. The\napplication's own escaping helper,\u00a0Dazadi.sql_txt(),\nis not invoked on these code paths, so a party that sends an invoice can break\nout of the string literal and alter the query logic.\n\n\n\n\n\n\n\n\n\nThis issue affects Zalktis: before 2026.1.586 and before 2026.2.592."}, {"lang": "es", "value": "Inyecci\u00f3n SQL en la aplicaci\u00f3n de contabilidad Zalktis a trav\u00e9s de campos de texto controlados por el socio comercial en facturas electr\u00f3nicas recibidas. Al importar una factura electr\u00f3nica recibida (UBL/PEPPOL) o una exportaci\u00f3n de comercio electr\u00f3nico, Zalktis concatena valores controlados por el socio directamente en el texto de la sentencia SQL utilizando concatenaci\u00f3n de cadenas, sin consultas parametrizadas ni escape. El propio ayudante de escape de la aplicaci\u00f3n, Dazadi.sql_txt(), no se invoca en estas rutas de c\u00f3digo, por lo que una parte que env\u00eda una factura puede salir del literal de cadena y alterar la l\u00f3gica de la consulta.\n\nEste problema afecta a Zalktis: antes de 2026.1.586 y antes de 2026.2.592."}], "lastModified": "2026-10-24T16:10:00.153", "sourceIdentifier": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158"}