CVE-2026-41422: Daptin vulnerable to SQL injection via unvalidated goqu.L() calls in aggregate API

Severity: high (CVSS 8.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-05-07 · updated 2026-06-17
Weakness: CWE-89

Description

Daptin is a GraphQL/JSON-API headless CMS. Prior to version 0.11.4, the /aggregate/:typename endpoint accepted column and group query parameters that were passed verbatim to goqu.L() — a raw SQL literal expression builder — without any validation. This bypassed all parameterization and allowed authenticated users with any valid session to inject arbitrary SQL expressions. This issue has been patched in version 0.11.4.

Affected products

daptin: before 0.11.4

References

https://github.com/daptin/daptin/releases/tag/v0.11.4
https://github.com/daptin/daptin/security/advisories/GHSA-rw2c-8rfq-gwfv

Get alerted when CVE-2026-41422 or the next vulnerability affects your stack