CVE-2026-6093

MediumCVSS 6.0

Published: 11/05/2026(UTC)Updated: 26/10/2026(UTC)Translated: 25/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.28%

21th percentile - higher than 21% of all known CVEs

Summary

Corteza contains a SQL injection vulnerability in its Microsoft SQL Server (MSSQL) backend when filtering Compose records by the meta field. This issue affects corteza: 2024.9.8.

Risk Assessment

An attacker could exploit this vulnerability to gain unauthorized access to or manipulate data in the database, potentially leading to data confidentiality and integrity breaches.

Recommendation

It is recommended to immediately update Corteza to the latest available version that includes a fix for this vulnerability. Also review and restrict access to the application.

Other vulnerabilities in Corteza

CVE-2026-108729Medium
Corteza through 2024.9.10 contains an incorrect authorization vulnerability in compose attachment endpoints that allows unauthenticated attackers to download private attachments by setting the URL kind segment to page, icon, or namespace. Attackers who know a private record or module attachment id can request the original or preview route without a token or signature to retrieve files across namespace and record permission boundaries.

Original NVD description (English source)

Corteza contains a SQL injection vulnerability in its Microsoft SQL Server (MSSQL) backend when filtering Compose records by the meta field.This issue affects corteza: 2024.9.8.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS