CVE-2026-6093: Corteza 2024.9.8 - SQL Injection in MSSQL JSON-path meta filter via incorrect T-SQL string escaping
Published May 11, 2026
·Updated
Corteza contains a SQL injection vulnerability in its Microsoft SQL Server (MSSQL) backend when filtering Compose records by the meta field.This issue affects corteza: 2024.9.8.
Affected Software
1 affected component
Corteza Corteza=2024.9.8
Event History
May 11, 2026
CVE Published
via MITRE·02:03 PM
Data Sourced
via MITRE·02:03 PM
DescriptionWeakness
Data Sourced
via NVD·04:17 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2026-6093?
CVE-2026-6093 is considered a high-severity SQL injection vulnerability affecting Corteza version 2024.9.8.
2
How do I fix CVE-2026-6093?
To fix CVE-2026-6093, upgrade Corteza to a version later than 2024.9.8 where the SQL injection flaw is addressed.
3
What systems are affected by CVE-2026-6093?
CVE-2026-6093 affects Corteza version 2024.9.8 running on Microsoft SQL Server.
4
What kind of attack does CVE-2026-6093 facilitate?
CVE-2026-6093 facilitates SQL injection attacks which can lead to unauthorized data access or manipulation.
5
Is this vulnerability remotely exploitable?
Yes, CVE-2026-6093 can be exploited remotely if attackers have access to the affected Corteza application.