SQL Injection in Zalktis Programmas (Sia "Zalktis Programmas")
CVE-2026-59109
SQL injection in the Zalktis accounting application via trading-partner-controlled text fields in received electronic invoices. When importing a received e-invoice (UBL/PEPPOL) or an e-commerce export, Zalktis concatenates partner-controlled values directly into SQL statement text using string concatenation, with neither parameterised queries nor escaping. The application's own escaping helper, Dazadi.sql_txt(), is not invoked on these code paths, so a party that sends an invoice can break out of the string literal and alter the query logic. This issue affects Zalktis: before 2026.1.586 and before 2026.2.592.
Vulnerability class: Drupalgeddon 2 (CVE-2018-7600)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.005 (36.9th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 37th percentile — 36.9% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.003 · newest: 0.005 · change: +0.001
Affected products
- Zalktis Programmas (Sia "Zalktis Programmas") — versions 0
Weakness classification (CWE)
References
- a6d3dc9e-0591-4a13-bce7-0f5b31ff6158 (technical-description)
- a6d3dc9e-0591-4a13-bce7-0f5b31ff6158 (permissions-required, government-resource)
- 134c704f-9b21-4f2e-91b3-4a467353bcc0
Frequently asked questions
- What is CVE-2026-59109?
- CVE-2026-59109 is a high-severity vulnerability in Zalktis Programmas (Sia "Zalktis Programmas"), classified under Improper Input Validation. CVSS score: 8.8/10. Published 2026-08-13.
- How severe is CVE-2026-59109?
- High severity. CVSS v3 base score is 8.8 out of 10.