https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 13 Oct 2026 01:19:37 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-309028 EUVD-2026-309028 https://cve.radiocsirt.org/vuln/euvd-2026-309028 https://cve.radiocsirt.org/vuln/fkie_cve-2026-41422 <p>Daptin is a GraphQL/JSON-API headless CMS. Prior to version 0.11.4, the /aggregate/:typename endpoint accepted column and group query parameters that were passed verbatim to goqu.L() — a raw SQL literal expression builder — without any validation. This bypassed all parameterization and allowed authenticated users with any valid session to inject arbitrary SQL expressions. This issue has been patched in version 0.11.4.</p> <p>Daptin is a GraphQL/JSON-API headless CMS. Prior to version 0.11.4, the /aggregate/:typename endpoint accepted column and group query parameters that were passed verbatim to goqu.L() — a raw SQL literal expression builder — without any validation. This bypassed all parameterization and allowed authenticated users with any valid session to inject arbitrary SQL expressions. This issue has been patched in version 0.11.4.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-41422 https://cve.radiocsirt.org/vuln/ghsa-rw2c-8rfq-gwfv <p><strong>Affected:</strong> Go: github.com/daptin/daptin</p> <p>## Summary</p> <p>The `/aggregate/:typename` endpoint accepted `column` and `group` query parameters that were passed verbatim to `goqu.L()` — a raw SQL literal expression builder — without any validation. This bypassed all parameterization and allowed authenticated users with any valid session to inject arbitrary SQL expressions.</p> <p>## Impact</p> <p>An authenticated low-privilege user could: - Extract data from any table via subquery: `(SELECT group_concat(email) FROM user_account) as leak` - Disclose database internals: `sqlite_version()`, `(SELECT sql FROM sqlite_master)` - Exfiltrate cross-table data via correlated subqueries</p> <p>The vulnerability was confirmed locally; `user_account.email` values were extracted via a crafted `column` parameter by a non-admin user.</p> <p>## Root Cause</p> <p>`goqu.L(userInput)` in `server/resource/resource_aggregate.go` inserted user-supplied query parameters directly into the SQL string with no validation.</p> <p>## Fix (v0.11.4)</p> <p>All `goqu.L()` calls on user-controlled input were eliminated and replaced with: - Structural expression parsing supporting all documented API forms - Schema-based column validation (column names checked against entity schema via `TableInfo().GetColumnByName()`) - Exact-match allowlist for aggregate functions (`count`, `sum`, `avg`, `min`, `max`, `first`, `last`) and scalar functions (`date`, `strftime`, `upper`, `lower`, etc.) - Safe goqu constructors (`goqu.I()`, `goqu.SUM()`, `goqu.Func()`) for all generated expressions - `allowedTables` sc…</p> <p><strong>Affected:</strong> Go: github.com/daptin/daptin</p> <p>## Summary</p> <p>The `/aggregate/:typename` endpoint accepted `column` and `group` query parameters that were passed verbatim to `goqu.L()` — a raw SQL literal expression builder — without any validation. This bypassed all parameterization and allowed authenticated users with any valid session to inject arbitrary SQL expressions.</p> <p>## Impact</p> <p>An authenticated low-privilege user could: - Extract data from any table via subquery: `(SELECT group_concat(email) FROM user_account) as leak` - Disclose database internals: `sqlite_version()`, `(SELECT sql FROM sqlite_master)` - Exfiltrate cross-table data via correlated subqueries</p> <p>The vulnerability was confirmed locally; `user_account.email` values were extracted via a crafted `column` parameter by a non-admin user.</p> <p>## Root Cause</p> <p>`goqu.L(userInput)` in `server/resource/resource_aggregate.go` inserted user-supplied query parameters directly into the SQL string with no validation.</p> <p>## Fix (v0.11.4)</p> <p>All `goqu.L()` calls on user-controlled input were eliminated and replaced with: - Structural expression parsing supporting all documented API forms - Schema-based column validation (column names checked against entity schema via `TableInfo().GetColumnByName()`) - Exact-match allowlist for aggregate functions (`count`, `sum`, `avg`, `min`, `max`, `first`, `last`) and scalar functions (`date`, `strftime`, `upper`, `lower`, etc.) - Safe goqu constructors (`goqu.I()`, `goqu.SUM()`, `goqu.Func()`) for all generated expressions - `allowedTables` sc…</p> https://cve.radiocsirt.org/vuln/ghsa-rw2c-8rfq-gwfv