CVE-2026-59109

Summary

SQL injection in the Zalktis accounting application via trading-partner-controlled text fields in received electronic invoices. When importing a received e-invoice (UBL/PEPPOL) or an e-commerce export, Zalktis concatenates partner-controlled values directly into SQL statement text using string concatenation, with neither parameterised queries nor escaping. The application's own escaping helper, Dazadi.sql_txt(), is not invoked on these code paths, so a party that sends an invoice can break out of the string literal and alter the query logic.

This issue affects Zalktis: before 2026.1.586 and before 2026.2.592.

Affected Software

VendorProductVersion RangeStatus
Zalktis Programmas (SIA “Zalktis Programmas”)Zalktis0 < 2026.1.586affected
Zalktis Programmas (SIA “Zalktis Programmas”)Zalktis0 < 2026.2.592affected

Weaknesses

  • CWE-89: CWE-89 Improper neutralization of special elements used in an SQL command ('SQL injection')
  • CWE-20: CWE-20 Improper input validation

Workarounds

Until a fixed build is deployed: do not import e-invoices or e-commerce exports received from untrusted senders, and keep restorable backups of the accounting database taken before any import.

References