CVE-2026-59109

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-59109", "assignerOrgId": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158", "state": "PUBLISHED", "assignerShortName": "ENISA", "dateReserved": "2026-07-02T15:47:36.965Z", "datePublished": "2026-08-13T16:40:01.751Z", "dateUpdated": "2026-08-14T17:46:15.377Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158", "shortName": "ENISA", "dateUpdated": "2026-08-13T16:40:01.751Z"}, "title": "Zalktis: SQL injection via partner-controlled fields in imported e-invoices", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-89", "description": "CWE-89 Improper neutralization of special elements used in an SQL command ('SQL injection')", "type": "CWE"}]}, {"descriptions": [{"lang": "en", "cweId": "CWE-20", "description": "CWE-20 Improper input validation", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-66", "descriptions": [{"lang": "en", "value": "CAPEC-66 SQL Injection"}]}, {"capecId": "CAPEC-7", "descriptions": [{"lang": "en", "value": "CAPEC-7 Blind SQL Injection"}]}], "affected": [{"vendor": "Zalktis Programmas (SIA \"Zalktis Programmas\")", "product": "Zalktis", "platforms": ["Windows"], "versions": [{"status": "affected", "version": "0", "lessThan": "2026.1.586", "versionType": "semver"}, {"status": "affected", "version": "0", "lessThan": "2026.2.592", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "SQL injection in the Zalktis accounting application via\ntrading-partner-controlled text fields in received electronic invoices. When\nimporting a received e-invoice (UBL/PEPPOL) or an e-commerce export, Zalktis\nconcatenates partner-controlled values directly into SQL statement text using\nstring concatenation, with neither parameterised queries nor escaping. The\napplication's own escaping helper,\u00a0Dazadi.sql_txt(),\nis not invoked on these code paths, so a party that sends an invoice can break\nout of the string literal and alter the query logic.\n\n\n\n\n\n\n\n\n\nThis issue affects Zalktis: before 2026.1.586 and before 2026.2.592.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p><span>SQL injection in the Zalktis accounting application via\ntrading-partner-controlled text fields in received electronic invoices. When\nimporting a received e-invoice (UBL/PEPPOL) or an e-commerce export, Zalktis\nconcatenates partner-controlled values directly into SQL statement text using\nstring concatenation, with neither parameterised queries nor escaping. The\napplication's own escaping helper,&nbsp;</span><code><span>Dazadi.sql_txt()</span></code><span>,\nis not invoked on these code paths, so a party that sends an invoice can break\nout of the string literal and alter the query logic.</span></p>\n\n\n\n\n\n<p>This issue affects Zalktis: before 2026.1.586 and before 2026.2.592.</p>"}]}], "references": [{"url": "https://offseq.com/en/research/zalktis-cve-2026-59109", "tags": ["technical-description"]}, {"url": "https://cvd.cert.lv/disclosed/vuln-all-631428755", "tags": ["government-resource", "permissions-required"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "baseSeverity": "HIGH", "baseScore": 8.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"}}, {"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "PASSIVE", "vulnConfidentialityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subIntegrityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "HIGH", "baseScore": 8.7, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}}], "workarounds": [{"lang": "en", "value": "Until a fixed build is deployed: do not import e-invoices or\ne-commerce exports received from untrusted senders, and keep restorable backups\nof the accounting database taken before any import.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p><span>Until a fixed build is deployed: do not import e-invoices or\ne-commerce exports received from untrusted senders, and keep restorable backups\nof the accounting database taken before any import.</span></p>"}]}], "solutions": [{"lang": "en", "value": "The vendor addressed the issue by parameterising the affected\nqueries. Upgrade to 2026.1.586 (legacy branch) or 2026.2.592 (current branch)\nor later.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p><span>The vendor addressed the issue by parameterising the affected\nqueries. Upgrade to 2026.1.586 (legacy branch) or 2026.2.592 (current branch)\nor later.</span></p>"}]}], "credits": [{"lang": "en", "value": "Nils Putni\u0146\u0161, OffSeq (SIA SEQ)", "type": "finder"}, {"lang": "en", "value": "CERT-LV", "type": "coordinator"}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 1.0.4"}}, "adp": [{"references": [{"url": "https://offseq.com/en/research/zalktis-cve-2026-59109/", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-14T17:46:01.133135Z", "id": "CVE-2026-59109", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-14T17:46:15.377Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-59109", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-08-14T17:46:01.133135Z"}}}], "references": [{"url": "https://offseq.com/en/research/zalktis-cve-2026-59109/", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-14T17:46:11.181Z"}}], "cna": {"title": "Zalktis: SQL injection via partner-controlled fields in imported e-invoices", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "Nils Putni\u0146\u0161, OffSeq (SIA SEQ)"}, {"lang": "en", "type": "coordinator", "value": "CERT-LV"}], "impacts": [{"capecId": "CAPEC-66", "descriptions": [{"lang": "en", "value": "CAPEC-66 SQL Injection"}]}, {"capecId": "CAPEC-7", "descriptions": [{"lang": "en", "value": "CAPEC-7 Blind SQL Injection"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}, {"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.7, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Zalktis Programmas (SIA \"Zalktis Programmas\")", "product": "Zalktis", "versions": [{"status": "affected", "version": "0", "lessThan": "2026.1.586", "versionType": "semver"}, {"status": "affected", "version": "0", "lessThan": "2026.2.592", "versionType": "semver"}], "platforms": ["Windows"], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "The vendor addressed the issue by parameterising the affected\nqueries. Upgrade to 2026.1.586 (legacy branch) or 2026.2.592 (current branch)\nor later.", "supportingMedia": [{"type": "text/html", "value": "<p><span>The vendor addressed the issue by parameterising the affected\nqueries. Upgrade to 2026.1.586 (legacy branch) or 2026.2.592 (current branch)\nor later.</span></p>", "base64": false}]}], "references": [{"url": "https://offseq.com/en/research/zalktis-cve-2026-59109", "tags": ["technical-description"]}, {"url": "https://cvd.cert.lv/disclosed/vuln-all-631428755", "tags": ["government-resource", "permissions-required"]}], "workarounds": [{"lang": "en", "value": "Until a fixed build is deployed: do not import e-invoices or\ne-commerce exports received from untrusted senders, and keep restorable backups\nof the accounting database taken before any import.", "supportingMedia": [{"type": "text/html", "value": "<p><span>Until a fixed build is deployed: do not import e-invoices or\ne-commerce exports received from untrusted senders, and keep restorable backups\nof the accounting database taken before any import.</span></p>", "base64": false}]}], "x_generator": {"engine": "Vulnogram 1.0.4"}, "descriptions": [{"lang": "en", "value": "SQL injection in the Zalktis accounting application via\ntrading-partner-controlled text fields in received electronic invoices. When\nimporting a received e-invoice (UBL/PEPPOL) or an e-commerce export, Zalktis\nconcatenates partner-controlled values directly into SQL statement text using\nstring concatenation, with neither parameterised queries nor escaping. The\napplication's own escaping helper,\u00a0Dazadi.sql_txt(),\nis not invoked on these code paths, so a party that sends an invoice can break\nout of the string literal and alter the query logic.\n\n\n\n\n\n\n\n\n\nThis issue affects Zalktis: before 2026.1.586 and before 2026.2.592.", "supportingMedia": [{"type": "text/html", "value": "<p><span>SQL injection in the Zalktis accounting application via\ntrading-partner-controlled text fields in received electronic invoices. When\nimporting a received e-invoice (UBL/PEPPOL) or an e-commerce export, Zalktis\nconcatenates partner-controlled values directly into SQL statement text using\nstring concatenation, with neither parameterised queries nor escaping. The\napplication's own escaping helper,&nbsp;</span><code><span>Dazadi.sql_txt()</span></code><span>,\nis not invoked on these code paths, so a party that sends an invoice can break\nout of the string literal and alter the query logic.</span></p>\n\n\n\n\n\n<p>This issue affects Zalktis: before 2026.1.586 and before 2026.2.592.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-89", "description": "CWE-89 Improper neutralization of special elements used in an SQL command ('SQL injection')"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-20", "description": "CWE-20 Improper input validation"}]}], "providerMetadata": {"orgId": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158", "shortName": "ENISA", "dateUpdated": "2026-08-13T16:40:01.751Z"}}}, "cveMetadata": {"cveId": "CVE-2026-59109", "state": "PUBLISHED", "dateUpdated": "2026-08-14T17:46:15.377Z", "dateReserved": "2026-07-02T15:47:36.965Z", "assignerOrgId": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158", "datePublished": "2026-08-13T16:40:01.751Z", "assignerShortName": "ENISA"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "platforms": ["Windows"], "product": "Zalktis", "vendor": "Zalktis Programmas (SIA \"Zalktis Programmas\")", "versions": [{"lessThan": "2026.1.586", "status": "affected", "version": "0", "versionType": "semver"}, {"lessThan": "2026.2.592", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "SQL injection in the Zalktis accounting application via\ntrading-partner-controlled text fields in received electronic invoices. When\nimporting a received e-invoice (UBL/PEPPOL) or an e-commerce export, Zalktis\nconcatenates partner-controlled values directly into SQL statement text using\nstring concatenation, with neither parameterised queries nor escaping. The\napplication's own escaping helper,\u00a0Dazadi.sql_txt(),\nis not invoked on these code paths, so a party that sends an invoice can break\nout of the string literal and alter the query logic.\n\n\n\n\n\n\n\n\n\nThis issue affects Zalktis: before 2026.1.586 and before 2026.2.592."}, {"lang": "es", "value": "Inyecci\u00f3n SQL en la aplicaci\u00f3n de contabilidad Zalktis a trav\u00e9s de campos de texto controlados por el socio comercial en facturas electr\u00f3nicas recibidas. Al importar una factura electr\u00f3nica recibida (UBL/PEPPOL) o una exportaci\u00f3n de comercio electr\u00f3nico, Zalktis concatena valores controlados por el socio directamente en el texto de la sentencia SQL utilizando concatenaci\u00f3n de cadenas, sin consultas parametrizadas ni escape. El propio ayudante de escape de la aplicaci\u00f3n, Dazadi.sql_txt(), no se invoca en estas rutas de c\u00f3digo, por lo que una parte que env\u00eda una factura puede salir del literal de cadena y alterar la l\u00f3gica de la consulta.\n\nEste problema afecta a Zalktis: antes de 2026.1.586 y antes de 2026.2.592."}], "id": "CVE-2026-59109", "lastModified": "2026-10-24T16:10:00.153", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.7, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-59109", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-08-14T17:46:01.133135Z", "version": "2.0.3"}}]}, "published": "2026-08-13T17:17:29.207", "references": [{"source": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158", "url": "https://cvd.cert.lv/disclosed/vuln-all-631428755"}, {"source": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158", "url": "https://offseq.com/en/research/zalktis-cve-2026-59109"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://offseq.com/en/research/zalktis-cve-2026-59109/"}], "sourceIdentifier": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-20"}, {"lang": "en", "value": "CWE-89"}], "source": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": ["windows"], "status": "affected", "versions": {"scheme": "semver", "value": "[0,2026.1.586)"}}, {"platform": ["windows"], "status": "affected", "versions": {"scheme": "semver", "value": "[0,2026.2.592)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "Zalktis", "source": "cna", "vendor": "Zalktis Programmas (SIA \"Zalktis Programmas\")"}, "product": "zalktis", "vendor": "zalktis_programmas"}], "created": "2026-08-13T19:15:03.453235+00:00", "updated": "2026-08-14T09:31:05.058626+00:00", "vendors": ["zalktis_programmas", "zalktis_programmas$PRODUCT$zalktis"]}