---
id: CVE-2026-110733
title: >-
  Apache SIS: SQL injection via unvalidated ORDER BY sort expression in the SQL
  feature store
summary: >-
  Vulnerability in the SQL storage module of Apache SIS. When sorting a stream
  of features, the clause is copied after ORDER BY without quoting the
  identifier character. A crafter sort clause could inject SQL in the query.






  This issue …
severity: medium
cvss: 5.4
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L'
cvssSource: adp
cwe:
  - CWE-89
vendor: Apache Software Foundation
product: 'org.apache.sis.storage:sis-sqlstore'
affected:
  - 'org.apache.sis.storage:sis-sqlstore >= 1.0 <= 1.6.0'
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-26T16:28:56.170596Z'
published: '2026-10-26'
updated: '2026-10-26'
sourceUpdated: '2026-10-26T16:29:01.382Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-110733'
references:
  - url: 'https://lists.apache.org/thread.html/j43dd1okv97o0qygbox381l01rsszsln'
tags:
  - cve.org
ingestedAt: '2026-10-26T15:29:30.533Z'
---

## Overview

Vulnerability in the SQL storage module of Apache SIS. When sorting a stream of features, the clause is copied after ORDER BY without quoting the identifier character. A crafter sort clause could inject SQL in the query.





This issue affects the sql-storage module of Apache SIS from version 1.0 through 1.6 inclusive. Other modules such as sis-referencing are not impacted. Users are recommended to upgrade to version 1.7, which fixes the issue.

## Affected

- `org.apache.sis.storage:sis-sqlstore >= 1.0 <= 1.6.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.