CVE-2026-59109
Description
SQL injection in the Zalktis accounting application via trading-partner-controlled text fields in received electronic invoices. When importing a received e-invoice (UBL/PEPPOL) or an e-commerce export, Zalktis concatenates partner-controlled values directly into SQL statement text using string concatenation, with neither parameterised queries nor escaping. The application's own escaping helper, Dazadi.sql_txt(), is not invoked on these code paths, so a party that sends an invoice can break out of the string literal and alter the query logic. This issue affects Zalktis: before 2026.1.586 and before 2026.2.592.
How to fix
- Zalktis Programmas (SIA "Zalktis Programmas") Zalktis2026.1.586, 2026.2.592 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Zalktis Programmas (SIA "Zalktis Programmas") Zalktis | v < 2026.1.586, v < 2026.2.592 | 2026.1.586, 2026.2.592 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.