PT-2026-35085 · Saltcorn · Saltcorn

Qiaonpc · Published 2026-04-16 · Updated 2026-04-24 · CVE-2026-41478

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Saltcorn versions prior to 1.4.6 Saltcorn versions prior to 1.5.6 Saltcorn versions prior to 1.6.0-beta.5

Description Saltcorn is an extensible, open source, no-code database application builder. A SQL injection in the mobile-sync routes allows any authenticated low-privilege user with read access to at least one table to inject arbitrary SQL through sync parameters. This can result in full database exfiltration, including admin password hashes and configuration secrets, and may enable database modification or destruction depending on the backend.

Recommendations Update to version 1.4.6 Update to version 1.5.6 Update to version 1.6.0-beta.5

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2026-41478

GHSA-JP74-MFRX-3QVH

Affected Products

Saltcorn

References · 6

• 🔥 https://github.com/saltcorn/saltcorn/security/advisories/GHSA-jp74-mfrx-3qvh · Exploit
• https://osv.dev/vulnerability/GHSA-jp74-mfrx-3qvh · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-41478 · Security Note
• https://github.com/saltcorn/saltcorn · Note
• https://twitter.com/CVEnew/status/2047798551401644297 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2047820939774054875 · Twitter Post