Skip to content
OpenAdvisories

Package · Go

github.com/daptin/daptin

5 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • High 8.7
    CVE-2026-62160

    Daptin: ParseAcceptLanguage `_` separator bypass enables >250x CPU amplification via Accept-Language header in LanguageMiddleware

    Daptin is a GraphQL/JSON-API headless CMS. Prior to 0.12.26, the global `LanguageMiddleware` in `server/language.go` passes the raw `Accept-Language` header from `LanguageMiddlewareFunc` through `GetLanguagePreference` to `golang.org/x/text/language.ParseAcce…

    daptin daptin github.com/daptin/daptin Go
  • High 7.1
    CVE-2026-44349

    Daptin fuzzy search injects unvalidated column name into raw SQL

    Daptin is a GraphQL/JSON-API headless CMS. Prior to version 0.11.5, processFuzzySearch in server/resource/resource_findallpaginated.go:1484 splits the user-supplied column parameter by comma and interpolates each segment directly into goqu.L(fmt.Sprintf("LOWE…

    daptin daptin github.com/daptin/daptin Go
  • High 8.3
    CVE-2026-41422

    Daptin vulnerable to SQL injection via unvalidated goqu.L() calls in aggregate API

    Daptin is a GraphQL/JSON-API headless CMS. Prior to version 0.11.4, the /aggregate/:typename endpoint accepted column and group query parameters that were passed verbatim to goqu.L() — a raw SQL literal expression builder — without any validation. This bypass…

    daptin daptin github.com/daptin/daptin Go