SQL injection in Corteza - CVE-2026-6093
Published: October 19, 2026
Vulnerability details
The vulnerability allows a remote user to execute injected SQL expressions, disclose sensitive database information, and manipulate query results.
The vulnerability exists due to incorrect T-SQL string escaping in the MSSQL JSON-path filter in server/store/adapters/rdbms/drivers/mssql/json.go when filtering Compose records using JSON-formatted meta parameters. The jsonPath function escapes single quotes as ' rather than '', while payload.ParseMeta skips key validation for JSON objects, allowing supplied keys to terminate SQL string literals. A remote user can submit a crafted meta filter to /compose/namespace/{nsID}/module/{modID}/record/ with records.search permission on the module, using a key such as foo') ELSE CASE WHEN LEN(db_name()) > 5 THEN 1 ELSE 0 END END > 0) AND 1=1)-- to alter query conditions and extract database information through boolean responses.
Exploitation requires at least one record in the module; a record with meta = NULL reliably triggers the injected ELSE branch.