VulnerabilityDeferred

CVE-2026-110733

Vulnerability in the SQL storage module of Apache SIS.

MEDIUM 5.4EPSS —

Does this matter?

Lower severity and no EPSS score yet. Track it; it rarely justifies an emergency change on its own.

Description

Vulnerability in the SQL storage module of Apache SIS. When sorting a stream of features, the clause is copied after ORDER BY without quoting the identifier character. A crafter sort clause could inject SQL in the query. This issue affects the sql-storage module of Apache SIS from version 1.0 through 1.6 inclusive. Other modules such as sis-referencing are not impacted. Users are recommended to upgrade to version 1.7, which fixes the issue.

CVSS 3.1: 5.4 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L
EPSS: No score yet
Public exploits: None in Exploit-DB
CISA KEV: Not listed
Weakness: CWE-89
Source: security@apache.org

References

https://lists.apache.org/thread.html/j43dd1okv97o0qygbox381l01rsszsln

Source: NVD record, EPSS from FIRST.org, KEV from CISA, exploits from Exploit-DB. Refreshed daily. Download this record as JSON.