OpenRemote is an open-source internet-of-things platform. Prior to 1.26.0, the "datapoint export" API constructs "CSV crosstab" SQL by concatenating an "asset name" and "attribute name" into a "COPY" query that uses "crosstab" and streams "TO STDOUT". The "asset name" enters both a double-quoted column identifier and a category query enclosed by the fixed "$cat$" delimiter. Escaping single quotes in one string context does not escape embedded double quotes in identifiers or protect that dollar-quote boundary. An authenticated user permitted to create or rename an asset and read/export datapoints for one of its attributes can store SQL metacharacters in the name and request a "crosstab" export, causing injected SELECT output to be returned in the normal ZIP/CSV response. This enables database exfiltration without direct database or filesystem access or token forgery. In a multi-tenant deployment it can expose other tenants' data if the manager's database role can read shared tables; integrity and availability effects are not established by the demonstrated read primitive. This issue is fixed in version 1.26.0.