--- schema: 1 kind: vulnerability title: "Zalktis (Latvian accounting software): unauthenticated SQL injection reachable by any PEPPOL/UBL e-invoice sender — no account, no network position, just a routine bookkeeping import (CVE-2026-59109)" headline: "A trading partner you have never dealt with can reach your accounting database through a mandatory e-invoice import, with no phishing and no credentials" summary: > CVE-2026-59109, coordinated through Latvia's CERT.LV vulnerability-disclosure platform, is an unauthenticated SQL injection in Zalktis, a Windows accounting application, reachable through the everyday act of importing a received electronic invoice over the EU-wide PEPPOL/UBL e-invoicing network. Four import code paths concatenate trading-partner-controlled fields directly into SQL with no escaping; one fires automatically on every imported invoice line with no attacker targeting required. Fixed in Zalktis 2026.1.586 / 2026.2.592. discovered_at: "2026-08-28T05:40:00Z" updated_at: null event_date: "2026-06-30" run_id: 2026-08-28T0409Z-intel priority: notable immediate_action: null tags: [vulnerabilities, sqli, pre-auth, patch-available, supply-chain] regions: [europe] sectors: [public-sector, finance] entities: [] techniques: [T1190] affected_products: ["Zalktis accounting software"] cves: - id: CVE-2026-59109 cvss: "8.8" epss: null type: sqli vector: user-interaction auth: pre-auth status: [patch-available] affected: "Zalktis pre-1-July branch below 2026.1.586; post-1-July branch below 2026.2.592" fixed: "2026.1.586 (pre-1-July branch); 2026.2.592 (post-1-July branch)" sources: - url: "https://offseq.com/en/research/zalktis-cve-2026-59109/" publisher: "OffSeq Cybersecurity" date: "2026-06-30" role: primary closed_sources: [] evidence: - quote: "OffSeq found that Zalktis built the SQL behind those imports by pasting fields taken straight from the incoming document into the query text." publisher: "OffSeq Cybersecurity" - quote: "No account, prior relationship or network position is needed – on the PEPPOL network anyone can address an invoice to the victim, and the only step the victim takes is importing it." publisher: "OffSeq Cybersecurity" - quote: "The application ships an escaping helper, Dazadi.sql_txt(), that strips single quotes — but it is never called on these import paths." publisher: "OffSeq Cybersecurity" verification: single-source sourcing_note: > OffSeq is the discoverer and primary technical source; the CVE record itself (assigned by ENISA as CNA and referencing the CERT.LV disclosure) confirms only the identifier, affected range and coordinating authority — it does not corroborate the substantive technical claims (the four vulnerable code paths, the missing-escaping-helper detail, the password-extraction PoC), which rest on OffSeq alone. Credibility is held at 2 rather than 1 for that reason: the CVE's existence is independently confirmed, but the technical substance is a single assessor's account. Latvia's own cvd.cert.lv detail page for this record had not been populated at fetch time despite the CVE citing it as a reference. confidence: high references: [] deep_dive: false deep_dive_category: null org_triage: null classification: reliability: B credibility: 2 watchlist_hit: false actions: [] updates: - at: "2026-09-29T23:44:28Z" run_id: 2026-09-29T2134Z-audit type: correction summary: > Priority moves from high to notable: the flaw is vendor-patched, not reported exploited, and sits in a Latvian desktop accounting product, so it is an awareness item for its transferable e-invoicing lesson rather than an out-of-cycle action. The OffSeq quotation that joined two sentences across an omitted one is now two quotations, the NVD data-sheet link is removed from the sources, and verification is recorded as single-source, which is what the sourcing note already described. The analysis quotes the same two sentences separately, and the sourcing note loses a clause about citation practice. The upgrade action is withdrawn, since a notable awareness item carries no do-now task for this readership, and the fixed builds stay in the analysis. The sourcing note names ENISA as the CVE assigner, and the disclosure timeline cites OffSeq. fields: [evidence, sources, sourcing_note, verification, priority, actions, body] migrated_from: null --- CVE-2026-59109, coordinated via Latvia's CERT.LV vulnerability-disclosure platform, is an unauthenticated SQL injection in Zalktis, a Windows accounting application used by Latvian businesses, reachable through the everyday act of importing a received electronic invoice over the PEPPOL/UBL e-address network. When Zalktis imports an invoice or e-commerce export, four validation lookups concatenate trading-partner-controlled fields directly into SQL string literals with no parameterization and no escaping: the buyer/seller registration number (`DatuParbaude.cs:320`), the VAT number (`DatuParbaude.cs:459`), the EAN/barcode (`DatuParbaude.cs:763`), and the invoice line's unit-of-measure code taken from the `` XML attribute (`frmreksaraksti.cs:3381`). The application ships an escaping helper for exactly this purpose — "the application ships an escaping helper, Dazadi.sql_txt(), that strips single quotes — but it is never called on these import paths" ([OffSeq Cybersecurity, 2026-06-30](https://offseq.com/en/research/zalktis-cve-2026-59109/)). The unit-of-measure path is the most dangerous of the four because it fires automatically for every line of every imported invoice with no attacker targeting required. OffSeq demonstrated boolean-based (`'1'='1'` vs `'1'='2'`) and UNION-based extraction, retrieving `Lietotajs.Parole` (user password) values from the accounting database in testing. CVSS 4.0 8.7 High / CVSS 3.1 8.8 High (`AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H`) — the only "interaction" required is the victim's routine act of importing the invoice, not a security decision. The researchers write that "OffSeq found that Zalktis built the SQL behind those imports by pasting fields taken straight from the incoming document into the query text" and that "No account, prior relationship or network position is needed – on the PEPPOL network anyone can address an invoice to the victim, and the only step the victim takes is importing it" ([OffSeq Cybersecurity, 2026-06-30](https://offseq.com/en/research/zalktis-cve-2026-59109/)). The vulnerable pattern is shared across roughly 20 import channels in the application, so every installation that imports documents is affected. OffSeq reported it through CERT.LV on 2026-06-30, the vendor confirmed the fix on 2026-07-16 and the CVE was reserved on 2026-07-30, with fixed builds Zalktis 2026.1.586 (pre-1-July branch) and 2026.2.592 (post-1-July branch) ([OffSeq Cybersecurity, 2026-06-30](https://offseq.com/en/research/zalktis-cve-2026-59109/)). The generalisable lesson extends past this one product: PEPPOL e-invoicing is mandated across European public procurement, so "a trading partner's invoice field reaches your SQL statement" transfers to any administration running e-invoice intake regardless of which accounting package it uses, wherever that package parses trading-partner-controlled document fields without parameterized queries. **Triage:** unauthenticated SQL-metacharacter content in structured e-invoice fields that should carry only registration numbers, VAT numbers, EAN codes or unit-of-measure codes is the discriminator — those fields are structured identifiers by specification, so any content resembling SQL syntax in them has no legitimate business explanation regardless of which system parses the document. ## Correction — 2026-09-29T23:44:28Z The flaw is fixed by the vendor, has not been reported exploited, and sits in a desktop accounting product used by Latvian businesses, so it is an item for the normal patch cycle rather than an out-of-cycle one: Zalktis operators move to 2026.1.586 or 2026.2.592 ([OffSeq Cybersecurity, 2026-06-30](https://offseq.com/en/research/zalktis-cve-2026-59109/)). The transferable lesson stands: an e-invoice field from any trading partner can reach an accounting system's SQL, and PEPPOL makes that trading partner anyone on the network.