{"id":"CVE-2026-110733","kind":"vulnerability","aliases":["CVE-2026-110733"],"related":[],"title":"Apache SIS: crafted sort clause injects SQL into feature queries","description":"Vulnerability in the SQL storage module of Apache SIS. When sorting a stream of features, the clause is copied after ORDER BY without quoting the identifier character. A crafter sort clause could inject SQL in the query.\n\n\n\n\n\nThis issue affects the sql-storage module of Apache SIS from version 1.0 through 1.6 inclusive. Other modules such as sis-referencing are not impacted. Users are recommended to upgrade to version 1.7, which fixes the issue.","summary":"The SQL storage module of Apache SIS copies a sort clause into an ORDER BY statement without quoting identifiers, so a crafted sort clause can inject SQL. An attacker who controls the sort clause can run arbitrary SQL against the backing database.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["apache-sis","java","package","self-hosted","sql"],"not_affected_if":["no-sql-storage","server-fixed-sort-clauses","sis-referencing-only"],"how_to_check":"- Check the sis-sql-storage version in your build file (for example with `mvn dependency:list` or `gradle dependencies`) and see whether it falls between `1.0` and `1.6`.\n- Look for code that passes user-supplied sort or order parameters into feature stream queries on the SQL storage module.","fix":"- Upgrade the Apache SIS sql-storage module to `1.7`.","status":"open","published_at":"2026-10-26T15:16:36+00:00","first_seen_at":"2026-10-26T16:02:25+00:00","triaged_at":"2026-10-26T16:04:17+00:00","updated_at":"2026-10-26T16:04:17+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-26T16:04:17Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade the Apache SIS sql-storage module to `1.7`.","reach":"unknown","title":"Apache SIS: crafted sort clause injects SQL into feature queries","impact":"high","summary":"The SQL storage module of Apache SIS copies a sort clause into an ORDER BY statement without quoting identifiers, so a crafted sort clause can inject SQL. An attacker who controls the sort clause can run arbitrary SQL against the backing database.","category":"package","nicknames":[],"who_cares":["apache-sis","java","sql","self-hosted"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker runs arbitrary SQL against the backing database.","analyst_note":"Sources do not say whether authentication is required or what the exact sort-clause input path is; check the NVD entry and Apache SIS 1.7 release notes.","how_to_check":"- Check the sis-sql-storage version in your build file (for example with `mvn dependency:list` or `gradle dependencies`) and see whether it falls between `1.0` and `1.6`.\n- Look for code that passes user-supplied sort or order parameters into feature stream queries on the SQL storage module.","needs_analyst":true,"not_affected_if":["sis-referencing-only","no-sql-storage","server-fixed-sort-clauses"],"who_is_affected":"Applications that use the Apache SIS sql-storage module from `1.0` through `1.6` to read features from a SQL database, especially where the sort clause comes from user input. Modules such as sis-referencing are not affected according to the advisory. Teams that do not use the SQL storage module, or that fix sort clauses server-side, have less exposure.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000645,"input_tokens":3348,"output_tokens":620,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-110733':13A,16A '-2026':12A,15A '1.0':118C '1.6':120C '1.7':139C 'affect':107C 'apach':1A,18B,31B,75C,114C 'apache-si':17B 'arbitrari':62B 'attack':54B 'back':66B 'charact':94C 'claus':5A,36B,49B,59B,84C,98C 'control':56B 'copi':33B,86C 'could':99C 'craft':3A,47B 'crafter':96C 'cve':11A,14A 'databas':67B 'featur':9A,82C 'fix':141C 'host':24B 'identifi':44B,93C 'impact':131C 'inclus':121C 'inject':6A,51B,100C 'issu':106C,143C 'java':20B 'modul':29B,73C,112C,123C 'order':39B,88C 'packag':21B 'queri':10A,104C 'quot':43B,91C 'recommend':134C 'referenc':128C 'run':61B 'self':23B 'self-host':22B 'sis':2A,19B,32B,76C,115C,127C 'sis-referenc':126C 'sort':4A,35B,48B,58B,78C,97C 'sql':7A,25B,27B,52B,63B,71C,101C,110C 'sql-storag':109C 'statement':41B 'storag':28B,72C,111C 'stream':80C 'upgrad':136C 'user':132C 'version':117C,138C 'vulner':68C 'without':42B,90C","nicknames":[],"mitigations":[],"who_affected":"Applications that use the Apache SIS sql-storage module from `1.0` through `1.6` to read features from a SQL database, especially where the sort clause comes from user input. Modules such as sis-referencing are not affected according to the advisory. Teams that do not use the SQL storage module, or that fix sort clauses server-side, have less exposure.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T15:16:36+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-110733","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110733","severity":null,"published_at":"2026-10-26T15:16:36+00:00","modified_at":"2026-10-26T15:16:36+00:00","first_seen_at":"2026-10-26T16:02:25+00:00","fetched_at":"2026-10-26T16:02:25+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}