CVE-2026-59109
Received Received - Intake

SQL Injection in Zalktis Accounting Application

Publication date: 2026-08-13

Last updated on: 2026-08-13

Assigner: ENISA

Description
SQL injection in the Zalktis accounting application via trading-partner-controlled text fields in received electronic invoices. When importing a received e-invoice (UBL/PEPPOL) or an e-commerce export, Zalktis concatenates partner-controlled values directly into SQL statement text using string concatenation, with neither parameterised queries nor escaping. The application's own escaping helper, Dazadi.sql_txt(), is not invoked on these code paths, so a party that sends an invoice can break out of the string literal and alter the query logic. This issue affects Zalktis: before 2026.1.586 and before 2026.2.592.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-13
Last Modified
2026-08-13
Generated
2026-08-13
AI Q&A
2026-08-13
EPSS Evaluated
N/A
NVD
CVE-2026-59109
EUVD
EUVD-2026-58133

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
zalktis zalktis to 2026.1.586 (exc)
zalktis zalktis to 2026.2.592 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-89 The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
CWE-20 The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a SQL injection vulnerability in the Zalktis accounting application. It occurs when the application processes received electronic invoices or e-commerce exports. The vulnerability allows an attacker to inject malicious SQL code through partner-controlled text fields in invoices, which are then directly concatenated into SQL queries without proper sanitization or parameterized queries.

Impact Analysis

An attacker could exploit this to manipulate or extract sensitive data from the database, alter application behavior, or execute unauthorized commands. This could lead to financial fraud, data breaches, or system compromise if exploited by a malicious invoice sender.

Compliance Impact

This vulnerability could lead to unauthorized access or exposure of sensitive data, violating GDPR (data protection) and HIPAA (health information privacy) requirements. Organizations using affected Zalktis versions may face compliance violations, legal penalties, and reputational damage.

Mitigation Strategies

Upgrade Zalktis to version 2026.1.586 or later if using the 2026.1.x branch, or to version 2026.2.592 or later if using the 2026.2.x branch to address the SQL injection flaw.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-59109. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart