SB2026101950 - SQL injection in Corteza
Published: October 19, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 vulnerability.
1) SQL injection (CVE-ID: CVE-2026-6093)
CWE-ID: CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to execute injected SQL expressions, disclose sensitive database information, and manipulate query results.
The vulnerability exists due to incorrect T-SQL string escaping in the MSSQL JSON-path filter in server/store/adapters/rdbms/drivers/mssql/json.go when filtering Compose records using JSON-formatted meta parameters. The jsonPath function escapes single quotes as ' rather than '', while payload.ParseMeta skips key validation for JSON objects, allowing supplied keys to terminate SQL string literals. A remote user can submit a crafted meta filter to /compose/namespace/{nsID}/module/{modID}/record/ with records.search permission on the module, using a key such as foo') ELSE CASE WHEN LEN(db_name()) > 5 THEN 1 ELSE 0 END END > 0) AND 1=1)-- to alter query conditions and extract database information through boolean responses.
Exploitation requires at least one record in the module; a record with meta = NULL reliably triggers the injected ELSE branch.
Remediation
Install update from vendor's website.