SQL Injection Vulnerability in Apache SIS SQL Storage Module

CVE-2026-110733

What is CVE-2026-110733?

A vulnerability exists in the SQL storage module of Apache SIS that allows an attacker to inject malicious SQL code via a crafted sort clause. This occurs when sorting a stream of features, where the ORDER BY clause does not properly quote identifier characters. As a result, attackers may exploit this flaw, leading to unauthorized access to sensitive data or disruption of service. It is crucial for users of affected versions (1.0 to 1.6) to upgrade to version 1.7 to mitigate this risk. Other modules, such as sis-referencing, are not impacted.

References