CVE-2026-30860 Details

A remote code execution vulnerability has been identified in WeKnora versions prior to 0.2.12. The issue arises in the application's database query functionality, where the validation system fails to properly inspect child nodes within PostgreSQL array and row expressions. This oversight allows attackers to bypass SQL injection protections by embedding harmful PostgreSQL functions into these expressions. Exploitation involves chaining these functions with large object operations and library loading capabilities, enabling an unauthenticated attacker to execute arbitrary code on the database server with the privileges of the database user.

Users are advised to update WeKnora to version 0.2.12 or later. Additionally, PostgreSQL configurations should be reviewed to disable dynamic library loading and restrict database users to SELECT-only permissions.