CVE-2026-110733: Apache SIS: SQL injection via unvalidated ORDER BY sort expression in the SQL feature store

Q: Which Apache SIS deployments are affected?

Only deployments using the Apache SIS sql-storage module are affected, and the affected versions are 1.0 through 1.6 inclusive. Other modules, including sis-referencing, are not impacted.

Q: What must an attacker be able to control to exploit this issue?

An attacker needs to provide a crafted sort clause used when sorting a stream of features. The unvalidated expression is copied into the SQL ORDER BY clause, allowing SQL injection.

Q: What should teams do to remediate the issue?

Upgrade the Apache SIS sql-storage module to version 1.7, which fixes the issue.

Published Oct 26, 2026

Updated

Vulnerability in the SQL storage module of Apache SIS. When sorting a stream of features, the clause is copied after ORDER BY without quoting the identifier character. A crafter sort clause could inject SQL in the query.

This issue affects the sql-storage module of Apache SIS from version 1.0 through 1.6 inclusive. Other modules such as sis-referencing are not impacted. Users are recommended to upgrade to version 1.7, which fixes the issue.

Affected Software

1 affected component

Apache SIS sql-storage module>=1.0<=1.6

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Apache SIS sql-storage to a version that resolves this vulnerability.
Fixed in 1.7

Event History

Oct 26, 2026

CVE Published

via MITRE·02:15 PM

Data Sourced

via MITRE·02:15 PM

DescriptionWeakness

Frequently Asked Questions

Which Apache SIS deployments are affected?

Only deployments using the Apache SIS sql-storage module are affected, and the affected versions are 1.0 through 1.6 inclusive. Other modules, including sis-referencing, are not impacted.

What must an attacker be able to control to exploit this issue?

An attacker needs to provide a crafted sort clause used when sorting a stream of features. The unvalidated expression is copied into the SQL ORDER BY clause, allowing SQL injection.

What should teams do to remediate the issue?

Upgrade the Apache SIS sql-storage module to version 1.7, which fixes the issue.

CVE-2026-110733: Apache SIS: SQL injection via unvalidated ORDER BY sort expression in the SQL feature store

Affected Software

Remediation

Event History

Frequently Asked Questions

Which Apache SIS deployments are affected?

What must an attacker be able to control to exploit this issue?

What should teams do to remediate the issue?

Company

Resources

Contact

Frequently Asked Questions

Which Apache SIS deployments are affected?

What must an attacker be able to control to exploit this issue?

What should teams do to remediate the issue?