CVE-2026-110733
Apache SIS: SQL injection via unvalidated ORDER BY sort expression in the SQL feature store
CVSS Score
5.4
EPSS Score
0.0%
EPSS Percentile
0th
Vulnerability in the SQL storage module of Apache SIS. When sorting a stream of features, the clause is copied after ORDER BY without quoting the identifier character. A crafter sort clause could inject SQL in the query. This issue affects the sql-storage module of Apache SIS from version 1.0 through 1.6 inclusive. Other modules such as sis-referencing are not impacted. Users are recommended to upgrade to version 1.7, which fixes the issue.
| CWE | CWE-89 |
| Vendor | apache software foundation |
| Product | apache sis |
| Published | Oct 26, 2026 |
| Last Updated | Oct 26, 2026 |
Stay Ahead of the Next One
Get instant alerts for apache software foundation apache sis
Be the first to know when new medium vulnerabilities affecting apache software foundation apache sis are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Apache Software Foundation / Apache SIS
1.0 ≤ 1.6.0
References
Credits
🔍 Ho1aAs <[email protected]>