8.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-41422

CVE-2026-41422: Daptin vulnerable to SQL injection via unvalidated goqu.L() calls in aggregate API

Daptin is a GraphQL/JSON-API headless CMS. Prior to version 0.11.4, the /aggregate/:typename endpoint accepted column and group query parameters that were passed verbatim to goqu.L() — a raw SQL literal expression builder — without any validation. This bypassed all parameterization and allowed authenticated users with any valid session to inject arbitrary SQL expressions. This issue has been patched in version 0.11.4.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-41422

CVE-2026-41422:

8.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/daptin/daptin	go	< 0.11.4	0.11.4

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The primary vulnerability is a SQL injection flaw in the DbResource.DataStats function located in server/resource/resource_aggregate.go. The function took user-supplied column and group parameters from an aggregation request and passed them directly to goqu.L(). This function from the goqu library is used to create raw SQL literals, so passing unvalidated user input to it allowed for the injection of arbitrary SQL expressions. An authenticated user could exploit this to read data from any table in the database. The fix involved removing all goqu.L() calls on user input and replacing them with a robust parsing and validation mechanism. This new mechanism uses an allowlist for functions, validates column names against the database schema, and uses safe goqu constructors. Additionally, the same commit fixed two denial-of-service vulnerabilities. One was in DbResource.DataStats where uuid.MustParse could cause a panic with malformed UUIDs. The other was in ToOrderedExpressionArray which could panic if it received an empty string in its input.

Vulnerable functions

DbResource.DataStats

server/resource/resource_aggregate.go

The function directly uses user-provided 'project' and 'group' parameters in `goqu.L()` calls, which constructs a raw SQL expression. This allows for SQL injection by crafting malicious 'column' or 'group' query parameters. The function was also vulnerable to a DoS attack due to using `uuid.MustParse` which panics on malformed input.

ToOrderedExpressionArray

server/resource/resource_aggregate.go

The function was vulnerable to a denial-of-service attack. If an empty string was passed in the input slice `s`, it would cause an index-out-of-range panic when accessing `e[0]` because the loop iterates over all elements without checking for empty strings.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.