CVE-2026-59109
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Summary
SQL injection in the Zalktis accounting application via trading-partner-controlled text fields in received electronic invoices. When importing a received e-invoice (UBL/PEPPOL) or an e-commerce export, Zalktis concatenates partner-controlled values directly into SQL statement text using string concatenation, with neither parameterised queries nor escaping. The application's own escaping helper, Dazadi.sql_txt(), is not invoked on these code paths, so a party that sends an invoice can break out of the string literal and alter the query logic.
This issue affects Zalktis: before 2026.1.586 and before 2026.2.592.
Affected Software
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Zalktis Programmas (SIA “Zalktis Programmas”) | Zalktis | 0 < 2026.1.586 | affected |
| Zalktis Programmas (SIA “Zalktis Programmas”) | Zalktis | 0 < 2026.2.592 | affected |
Weaknesses
- CWE-89: CWE-89 Improper neutralization of special elements used in an SQL command ('SQL injection')
- CWE-20: CWE-20 Improper input validation
Workarounds
Until a fixed build is deployed: do not import e-invoices or e-commerce exports received from untrusted senders, and keep restorable backups of the accounting database taken before any import.
References
- https://offseq.com/en/research/zalktis-cve-2026-59109
- https://cvd.cert.lv/disclosed/vuln-all-631428755
Feedback
Was this page helpful?
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.