---
id: "CVE-2026-110733"
kind: "vulnerability"
aliases: ["CVE-2026-110733"]
title: "Apache SIS: crafted sort clause injects SQL into feature queries"
severity: "high"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["apache-sis", "java", "package", "self-hosted", "sql"]
not_affected_if: ["no-sql-storage", "server-fixed-sort-clauses", "sis-referencing-only"]
published_at: "2026-10-26T15:16:36+00:00"
first_seen_at: "2026-10-26T16:02:25+00:00"
updated_at: "2026-10-26T16:04:17+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-110733", "first_seen_at": "2026-10-26T16:02:25+00:00"}]
---

# Apache SIS: crafted sort clause injects SQL into feature queries

The SQL storage module of Apache SIS copies a sort clause into an ORDER BY statement without quoting identifiers, so a crafted sort clause can inject SQL. An attacker who controls the sort clause can run arbitrary SQL against the backing database.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the sis-sql-storage version in your build file (for example with `mvn dependency:list` or `gradle dependencies`) and see whether it falls between `1.0` and `1.6`.
- Look for code that passes user-supplied sort or order parameters into feature stream queries on the SQL storage module.

## Fix

- Upgrade the Apache SIS sql-storage module to `1.7`.

## Timeline

- 2026-10-26T16:02:25+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-110733

## From the sources

Vulnerability in the SQL storage module of Apache SIS. When sorting a stream of features, the clause is copied after ORDER BY without quoting the identifier character. A crafter sort clause could inject SQL in the query.





This issue affects the sql-storage module of Apache SIS from version 1.0 through 1.6 inclusive. Other modules such as sis-referencing are not impacted. Users are recommended to upgrade to version 1.7, which fixes the issue.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_