Corteza 2024.9.8 contains a SQL injection vulnerability that occurs when filtering Compose records by the meta field in its Microsoft SQL Server backend. The flaw arises from incorrect T‑SQL string escaping, allowing an attacker to inject arbitrary SQL code. This can result in unauthorized read or write operations on the database, potentially exposing sensitive business or user data and enabling further compromise of the application.

The affected product is Corteza version 2024.9.8. This impact applies to installations running on Linux, macOS, or Windows platforms as indicated by the provided CPE strings.

The CVSS score of 6.0 indicates a medium severity, and the EPSS score is currently not available, meaning the publicly reported exploitation probability is unclear. The vulnerability is not listed in CISA’s KEV catalog. Because the flaw relies on an incorrect string escape in a database query, an attacker who can influence the meta filter value—likely via a user-supplied input—can exploit the injection. Successful exploitation would allow data exfiltration or modification of data stored in the Composes table.