Description
Vulnerability in the SQL storage module of Apache SIS. When sorting a stream of features, the clause is copied after ORDER BY without quoting the identifier character. A crafter sort clause could inject SQL in the query.





This issue affects the sql-storage module of Apache SIS from version 1.0 through 1.6 inclusive. Other modules such as sis-referencing are not impacted. Users are recommended to upgrade to version 1.7, which fixes the issue.
Published: 2026-10-26
Score: 5.4 Medium
EPSS: n/a
KEV: No
Impact: SQL Injection
Action: Patch Immediately
AI Analysis

Impact

The sql-storage module of Apache SIS constructs an ORDER BY clause by inserting a supplied sort expression directly into a SQL query without quoting or validating the identifier. Because the identifier is not quoted, a crafted sort clause can inject arbitrary SQL into the query, allowing unintended execution of commands. This flaw is a classic SQL injection (CWE-89) that may compromise data integrity or confidentiality if exploited.

Affected Systems

Apache SIS versions 1.0 through 1.6 inclusive, affecting only the sql-storage module; auxiliary modules such as sis-referencing are not impacted.

Risk and Exploitability

The vulnerability has a moderate CVSS score of 5.4, no EPSS score is available, and it is not listed in CISA KEV. The likely attack vector is any interface that accepts ORDER BY parameters—such as a web service that returns feature streams—though this inference is derived from the described behavior.

Generated by OpenCVE AI on October 26, 2026 at 19:25 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade the sql-storage module to Apache SIS version 1.7 or later, which includes the patch for the ORDER BY injection.
  • Implement input validation or a whitelist of allowed ORDER BY expressions before incorporating them into SQL queries.
  • Restrict or limit access to the endpoint that accepts ORDER BY parameters, granting it only to trusted users with the minimal necessary privileges.

Generated by OpenCVE AI on October 26, 2026 at 19:25 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 26 Oct 2026 17:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 5.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 26 Oct 2026 15:00:00 +0000

Type Values Removed Values Added
Description Vulnerability in the SQL storage module of Apache SIS. When sorting a stream of features, the clause is copied after ORDER BY without quoting the identifier character. A crafter sort clause could inject SQL in the query. This issue affects the sql-storage module of Apache SIS from version 1.0 through 1.6 inclusive. Other modules such as sis-referencing are not impacted. Users are recommended to upgrade to version 1.7, which fixes the issue.
Title Apache SIS: SQL injection via unvalidated ORDER BY sort expression in the SQL feature store
Weaknesses CWE-89
References

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: apache

Published:

Updated: 2026-10-26T16:29:01.382Z

Reserved: 2026-10-14T15:35:24.535Z

Link: CVE-2026-110733

cve-icon Vulnrichment

Updated: 2026-10-26T16:28:53.275Z

cve-icon NVD

Status : Deferred

Published: 2026-10-26T15:16:36.673

Modified: 2026-10-26T17:17:15.350

Link: CVE-2026-110733

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-26T19:30:15Z

Weaknesses
  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')