CVE-2026-8297 is a critical (9.8) SQL injection in the GisLab Laboratory Management System from Gis Informatics Engineering Consulting Laboratory R&D and Software Services Inc. The record covers version 1.4.03 through 08072026. I could not confirm a fix, so contact the vendor and limit exposure.
What's affected
The record says the issue affects GisLab Laboratory Management System from 1.4.03 through 08072026. It names the vendor as Gis Informatics Engineering Consulting Laboratory R&D and Software Services Inc.
The record points to a Turkish national cybersecurity advisory, TR-26-0573. I could not read its content, and the record names no fixed version. Check that advisory and the vendor for the current status.
How to check if you're exposed
Find where the product is installed and which version it reports. If you cannot find a version string, ask the vendor. Check whether the application is reachable from the internet.
If it handles laboratory or patient related data, treat exposure as a priority question for your privacy and compliance owners too.
What to do now
- Find every GisLab installation and its version.
- Contact the vendor for a fixed release and read the national advisory TR-26-0573.
- Take the application off the public internet, or place it behind a VPN or an allow list.
- Add web application firewall rules for SQL injection as a stopgap, knowing they are not a fix.
- Review database logs and application logs for unusual queries.
Why it matters
The weakness is CWE-89, improper neutralization of special elements used in an SQL command. Input becomes part of a database statement instead of data.
The vector lists network access, no privileges and no user interaction with full impact, which gives 9.8. For lab systems the database often holds sensitive results. The record is not listed in CISA's KEV catalog, and I found no report of exploitation.
Quick check
Is there a patched version?
I could not confirm one. The record lists no fix, so ask the vendor and check the national advisory.
Sources
Last reviewed: 19 October 2026.
