Apache SIS EUVD-2026-109935

Exploitation requires that an application built on Apache SIS use the sql-storage module and perform sorting of a feature stream where the ORDER BY sort-clause identifier is derived from attacker-controllable input; the advisory states the clause is copied after ORDER BY without quoting the identifier character, so a crafted sort clause injects SQL. The flaw is limited to the sql-storage module (sis-referencing and other modules are explicitly not affected) and only to versions 1.0 through 1.6 inclusive. Reachability is the key limiting factor: if the consuming application never exposes the sort field to untrusted input, the vulnerability is not triggerable. Authentication requirements are not confirmed from available data because no CVSS vector was provided.

This is a CWE-89 SQL injection in the sql-storage module of Apache SIS, where a sort clause is copied after ORDER BY without quoting the identifier, allowing injection via a crafted sort clause. No CVSS score or vector is provided, no EPSS score is supplied, the CVE is not listed in CISA KEV, and no SSVC technical-impact/automatable breakdown is given - so most quantitative exploitation signals are absent and the only decision signal available is the vuln.today priority label of 'monitor', which indicates this is not currently treated as an urgent, actively-exploited issue. The single reference is an Apache advisory (mailing-list thread), not a proof-of-concept, so there is no public exploit identified at time of analysis. The practical risk is heavily conditional: Apache SIS is a Java geospatial library, so exploitability depends entirely on whether an application built on it exposes the feature-sorting sort clause to attacker-controlled input; where it does, SQL injection can yield high confidentiality and integrity impact, but where sorting is internal or hard-coded the flaw is not reachable. Net: treat as a genuine injection bug to remediate by upgrading, but absent KEV, EPSS, or a PoC the real-world priority aligns with the 'monitor' label rather than emergency patching. Authentication requirements cannot be confirmed because no CVSS vector was provided.

An application uses the Apache SIS sql-storage module to query and sort a stream of features, exposing the sort/ORDER BY field to user-supplied input. An attacker submits a crafted sort clause that breaks out of the unquoted identifier and injects additional SQL, which is executed against the backing database to read or alter data. No public proof-of-concept or exploit code is available at time of analysis.