CVE-2026-110733
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk25th percentile - higher than 25% of all known CVEs
Summary
In the SQL storage module of Apache SIS, when sorting a stream of features, the clause is copied after ORDER BY without quoting the identifier character. A crafted sort clause could inject SQL into the query. This affects the sql-storage module from version 1.0 through 1.6; other modules such as sis-referencing are not impacted.
Risk Assessment
The vulnerability may allow SQL injection and unauthorized data access or modification. Impact is limited to applications using the Apache SIS sql-storage module.
Recommendation
Update Apache SIS to version 1.7, which fixes the issue. Until updated, avoid passing untrusted sort clauses to the sql-storage module.
Other vulnerabilities in Apache SIS
See all- CVE-2026-110748Medium
Apache SIS from version 0.7 through 1.6 opens files referenced by processed data regardless of their paths, potentially allowing a local file path to be specified. This affects GML with xlink:href attributes, WKT with datum shift grid parameter elements, and Landsat scenes with GeoTIFF band file paths. Reading stops at the first parsing error, making sensitive information leakage unlikely.
- CVE-2025-68280Medium
Apache SIS has an XML External Entity (XXE) vulnerability that allows an attacker to disclose local file contents on the server when parsing certain formats (GeoTIFF, ISO 19115, GML, GPX). Affects versions 0.4 through 1.5.
Original NVD description (English source)
Vulnerability in the SQL storage module of Apache SIS. When sorting a stream of features, the clause is copied after ORDER BY without quoting the identifier character. A crafter sort clause could inject SQL in the query. This issue affects the sql-storage module of Apache SIS from version 1.0 through 1.6 inclusive. Other modules such as sis-referencing are not impacted. Users are recommended to upgrade to version 1.7, which fixes the issue.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS