Skip to content
Sign in
Not rated

CVE-2026-110733 Vulnerability in the SQL storage module of Apache SIS

Description

Vulnerability in the SQL storage module of Apache SIS. When sorting a stream of features, the clause is copied after ORDER BY without quoting the identifier character. A crafter sort clause could inject SQL in the query. This issue affects the sql-storage module of Apache SIS from version 1.0 through 1.6 inclusive. Other modules such as sis-referencing are not impacted. Users are recommended to upgrade to version 1.7, which fixes the issue.

Affected products and versions

Product Affected versions Fixed in
Apache SIS 1.0 1.0 → 1.6.0 No fix stated

Other CVEs of Apache SIS

The 3 CVEs of Apache SIS →
CVE-2026-110748 This issue affects Apache SIS from version 0.7 through 1.6 inclusive Not rated CVE-2025-68280 Improper Restriction of XML External Entity Reference vulnerability in Apache SIS Not rated
Track this CVE