CVE search · CVE-2026-64618
CVE-2026-64618
critical 9.8
Improper Neutralization of Special Elements used in an SQL Command ("SQL Injection") vulnerability exists in Apache Fineract (through version 1.15.0). The vulnerability affects the outStandingAmountPercentageCondition parameter of the /fineract-provider/api/v1/search/advance HTTP API endpoint, allowing SQL injection due to insufficient input neutralization. Users are recommended to upgrade to version 1.16.1, which will fix the issue.
Details
- Status
- Modified
- Published
- Last changed
- Source
- security@apache.org
- Weakness
- CWE-89
Severity
| Version | Score | Vector | Source |
|---|---|---|---|
| CVSS 3.1 | critical 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
nvd@nist.govPrimary |
| CVSS 3.1 | critical 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
134c704f-9b21-4f2e-91b3-4a467353bcc0Secondary |
Affected products
Vendor and product from the NVD’s CPE applicability statements. Versions and conditions are on the NVD’s page.
- apache · fineract
References
- https://github.com/apache/fineract/pull/6153Issue TrackingPatch
- https://lists.apache.org/thread/s8orckszcd9x4d1qsloc046ppf5q9oc7Mailing ListVendor Advisory
- http://www.openwall.com/lists/oss-security/2026/10/30/4Mailing ListThird Party Advisory