Live › vulnerability › CVE-2026-110733
Go to dashboardThe SQL storage module of Apache SIS copies a sort clause into an ORDER BY statement without quoting identifiers, so a crafted sort clause can inject SQL. An attacker who controls the sort clause can run arbitrary SQL against the backing database.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-26 16:02 UTC. All times on this page are UTC.
Applications that use the Apache SIS sql-storage module from through to read features from a SQL database, especially where the sort clause comes from user input. Modules such as sis-referencing are not affected according to the advisory. Teams that do not use the SQL storage module, or that fix sort clauses server-side, have less exposure.
1.01.6No product ranges from the sources yet.
mvn dependency:list or gradle dependencies) and see whether it falls between 1.0 and 1.6.1.7.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Vulnerability in the SQL storage module of Apache SIS. When sorting a stream of features, the clause is copied after ORDER BY without quoting the identifier character. A crafter sort clause could inject SQL in the query.
This issue affects the sql-storage module of Apache SIS from version 1.0 through 1.6 inclusive. Other modules such as sis-referencing are not impacted. Users are recommended to upgrade to version 1.7, which fixes the issue.
This page as .md · .json · in your agent: get_signal("CVE-2026-110733")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.