EUVD-2026-64133
GHSA-mqjf-5f49-2fjh
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated remote SQL injection via user-supplied OGC filters (AV:N/PR:N/UI:N); AC:L as no evasion is needed once the JSON column feature is reachable; full SQL access yields C/I/A High.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
4DescriptionCVE.org
GeoTools is an open source Java library that provides tools for geospatial data. Starting in version 30.5 and prior to versions 33.6, 34.5, and 33.6, an SQL Injection Vulnerability is present when executing OGC Filters with PostGIS DataStore implementation: jsonArrayContains function; Requires PostGIS 12 or greater with a String or JSON field. For PostGIS 12 and greater jsonArrayContains(<column>, <pointer>, <value>) function writes <value> into generated SQL without escaping. Patches are available in versions 33.6, 34.5, and 33.6. No known workaround is available. To limit scope of SQL Injection the PostGIS connection pool should be configured with limited rights.
Articles & Coverage 1
AnalysisAI
SQL injection in the GeoTools Java geospatial library (gt-jdbc-postgis module) lets remote unauthenticated attackers execute arbitrary SQL against PostGIS-backed layers via the OGC Filter jsonArrayContains function. Affected builds run from 30.5 up to the fixed 33.6, 34.5, and 35.1 releases, where the function's value argument is written into generated SQL without escaping. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires an application that exposes GeoTools OGC/CQL filter evaluation to attacker-controlled input against a PostGIS DataStore, the jsonArrayContains function being usable in that filter, a PostGIS backend at version 12 or greater, and the target column being a String or JSON/jsonb field. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 base score is 9.8 (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H), and EPSS was not provided. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker submits a crafted OGC/CQL filter to a public GeoServer-style endpoint that queries a PostGIS layer with a JSON column, calling jsonArrayContains(col, pointer, value) with a value containing an embedded quote to break out of the JSONPath literal and append arbitrary SQL. Because no authentication is required (PR:N) and complexity is low (AC:L), the injected SQL executes with the connection pool's database privileges, enabling data theft or modification. … |
| Remediation | Vendor-released patch: upgrade gt-jdbc-postgis to 33.6, 34.5, or 35.1 depending on your branch (release tags: https://github.com/geotools/geotools/releases/tag/33.6, /34.5, /35.1; fix in PR https://github.com/geotools/geotools/pull/5829 and commit d821c4d321dd91c22e31fcd5b1ce676645da5176). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all systems running GeoTools versions 30.5 through 33.5, 34.4, or 35.0 that use PostGIS, and prioritize by whether they are internet-facing or process sensitive location data. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Oracle Java SE 7 Update 6 and earlier contains multiple sandbox bypass vulnerabilities via the ClassFinder and forName m
Remote code execution in IBM Sterling B2B Integrator, Sterling Integrator, and Tivoli Common Reporting allows unauthenti
Java Runtime Environment sandbox bypass via incorrect image channel verification in 2D component allows remote unauthent
Oracle Java SE JDK/JRE 7 and 6 Update 27 and earlier allows remote code execution with complete system compromise throug
JBoss Seam 2 in Red Hat JBoss EAP 4.3.0 fails to sanitize JBoss Expression Language inputs, allowing remote attackers to
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 update 4 and earlier, 6 up
Multiple vulnerabilities in Oracle Java 7 before Update 11 allow remote attackers to execute arbitrary code by (1) using
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Up
The WLS Security component in Oracle WebLogic Server 10.3.6.0, 12.1.2.0, 12.1.3.0, and 12.2.1.0 allows remote attackers
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier allow
Remote unauthenticated attackers can execute arbitrary code on Adobe ColdFusion servers through Java deserialization fla
The ExceptionDelegator component in Apache Struts before 2.2.3.1 interprets parameter values as OGNL expressions during
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today