CVE-2026-110733 Apache SIS: SQL injection via unvalidated ORDER BY sort expression in the SQL feature store
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-110733?
CVE-2026-110733 is a medium-severity vulnerability in Apache SIS, published on 26 Oct 2026.
Official description
Vulnerability in the SQL storage module of Apache SIS. When sorting a stream of features, the clause is copied after ORDER BY without quoting the identifier character. A crafter sort clause could inject SQL in the query.
This issue affects the sql-storage module of Apache SIS from version 1.0 through 1.6 inclusive. Other modules such as sis-referencing are not impacted. Users are recommended to upgrade to version 1.7, which fixes the issue.
Weakness: CWE-89
Which versions are affected by CVE-2026-110733?
How do I fix CVE-2026-110733?
No fix has been published for CVE-2026-110733 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-110733 being exploited?
There is no known exploitation of CVE-2026-110733 in the wild and no public exploit code.
Sources
Also known as GHSA-643p-v8jr-8f24.