CVE-2026-110733

Medium

Description

Vulnerability in the SQL storage module of Apache SIS. When sorting a stream of features, the clause is copied after ORDER BY without quoting the identifier character. A crafter sort clause could inject SQL in the query. This issue affects the sql-storage module of Apache SIS from version 1.0 through 1.6 inclusive. Other modules such as sis-referencing are not impacted. Users are recommended to upgrade to version 1.7, which fixes the issue.

SeverityMedium

CVSS5.4

Exploit probability—

ProductApache SIS

PublishedOct 26, 2026

First seenOct 26, 2026

Weakness typeCWE-89SQL injection

How to fix

Vendor advisories

lists.apache.org/thread.html/j43dd1okv97o0qygbox381l01rsszsln

Affected products

Product	Affected versions	Fixed in
Apache Software Foundation Apache SIS	1.0 ≤ v ≤ 1.6.0	—

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.