Zalktis Programmas (SIA "Zalktis Programmas") vulnerabilities and threats

CVE-2026-59109 is a high severity SQL injection vulnerability in the Zalktis accounting application. It occurs when importing received electronic invoices or e-commerce exports, where partner-controlled text fields are concatenated directly into SQL statements without proper escaping or parameterization. The application's escaping helper function is not applied on these code paths, allowing an attacker controlling invoice data to alter SQL query logic. This affects versions of Zalktis before 2026.1.586 and 2026.2.592.