GHSL-2026-059: SQL Injection in Chatwoot
The Chatwoot project version v4.11.0 contains a SQL Injection vulnerability (GHSL-2026-059) in the FilterService component, specifically within the ltgtfiltervalues function, allowing attackers to manipulate database queries and potentially access sensitive data.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Chatwoot (FilterService)to a version that resolves this vulnerability.Fixed in v4.11.0Patch GHSL-2026-059 - Compensating control
Mitigate the SQL injection risk in Chatwoot FilterService (lt_gt_filter_values) by restricting access to the affected functionality and protecting the application layer (e.g., WAF/ACL/rate limiting) to reduce the likelihood of malicious query manipulation.
Event History
Frequently Asked Questions
What is the severity of GHSL-2026-059?
The severity of GHSL-2026-059 is rated at 65, indicating a moderate risk level due to the potential for SQL Injection.
How do I fix GHSL-2026-059?
To fix GHSL-2026-059, upgrade to Chatwoot version v4.11.1 or later where the vulnerability has been addressed.
Which component is affected by GHSL-2026-059?
GHSL-2026-059 affects the FilterService component within the Chatwoot application.
What type of vulnerability is GHSL-2026-059?
GHSL-2026-059 is classified as a SQL Injection vulnerability that allows attackers to manipulate database queries.
What is the impact of GHSL-2026-059 on Chatwoot?
The impact of GHSL-2026-059 includes the potential for unauthorized access to sensitive data stored in the database.