PT-2026-38306 · Daptin · Daptin

Alpakalee · Published 2026-05-06 · Updated 2026-05-07 · CVE-2026-44349

Positive Technologies (AI Summary)

CVSS v4.0

7.1

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Daptin versions prior to 0.11.5

Description An issue exists in the processFuzzySearch function within server/resource/resource findallpaginated.go where the software fails to validate the column parameter against a whitelist. When using the 'GET /api/' endpoint with the operator parameter set to fuzzy, fuzzy any, or fuzzy all, the user-supplied column value is split by commas and interpolated directly into raw SQL queries. This allows any authenticated user, including those who self-registered, to perform boolean-blind SQL injection to read the entire database.

Technical details regarding the exploitation include:

• API Endpoint: 'GET /api/'
• Vulnerable Parameters: column and operator
• Vulnerable Function: processFuzzySearch()

Depending on the database driver, the injection may require specific fuzzy options.fallback mode values for PostgreSQL, MySQL, or MSSQL, while SQLite is vulnerable by default.

Recommendations Update to version 0.11.5. As a temporary workaround, restrict access to the 'GET /api/' endpoint or avoid using the fuzzy, fuzzy any, and fuzzy all operators until the update is applied.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2026-44349

GHSA-PWQG-Q8PG-PP6R

Affected Products

Daptin

References · 6

• 🔥 https://github.com/daptin/daptin/security/advisories/GHSA-pwqg-q8pg-pp6r · Exploit
• https://osv.dev/vulnerability/GHSA-pwqg-q8pg-pp6r · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-44349 · Security Note
• https://github.com/daptin/daptin/releases/tag/v0.11.5 · Note
• https://github.com/daptin/daptin · Note
• https://t.me/CVEtracker/53002 · Telegram Post