DEV Community

CVE Reports
CVE Reports

Posted on Originally published at cvereports.com

CVE-2026-76904: CVE-2026-76904: Unauthenticated SQL Injection in GeoTools PostGIS DataStore Component

#security #cve #cybersecurity

CVE-2026-76904: Unauthenticated SQL Injection in GeoTools PostGIS DataStore Component

Vulnerability ID: CVE-2026-76904
CVSS Score: 9.8
Published: 2026-08-21

A critical SQL injection vulnerability exists in the GeoTools open-source Java library. This vulnerability is situated within the post-processing phase of OGC Filter conversion inside the PostGIS DataStore module. Specifically, the jsonArrayContains function does not validate or sanitize its arguments before constructing PostgreSQL SQL/JSON path evaluation queries. An unauthenticated remote attacker can exploit this weakness by submitting crafted filters via standard OGC services like WFS or WMS to execute arbitrary SQL commands on the underlying database system.

TL;DR

An unauthenticated SQL injection vulnerability in the GeoTools jsonArrayContains OGC filter function allows remote attackers to execute arbitrary database commands and potentially achieve remote code execution by exploiting unsanitized input parsing in PostGIS database queries.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-89
  • Attack Vector: Network (AV:N)
  • CVSS v3.1: 9.8 (Critical)
  • Exploit Status: PoC (Proof of Concept)
  • Impact: Unauthenticated SQL Injection & potential Remote Code Execution
  • Component: gt-jdbc-postgis (PostGIS DataStore)
  • CISA KEV Status: Not Listed

Affected Systems

  • GeoTools geospatial library
  • GeoServer installations leveraging PostGIS data stores
  • Java-based spatial middleware utilizing gt-jdbc-postgis modules
  • GeoTools: >= 30.5, < 33.6 (Fixed in: 33.6)
  • GeoTools: >= 34.0, < 34.5 (Fixed in: 34.5)
  • GeoTools: 35.0 (Fixed in: 35.1)

Code Analysis

Commit: d821c4d

Remediation patch integrating escapeJsonLiteral within FilterToSqlHelper

@@ -800,7 +800,8 @@ private String constructEquality(String[] jsonPath, Expression expected) {
         } else if (value instanceof Double double1) {
             return "(@.%s == %f)".formatted(jsonPath[lastIndex], double1);
         }
-        return "(@.%s == \"%s\")".formatted(jsonPath[lastIndex], value);
+        String literal = escapeJsonLiteral(String.valueOf(value));
+        return "(@.%s == \"%s\")".formatted(jsonPath[lastIndex], literal);
     }
Enter fullscreen mode Exit fullscreen mode

Mitigation Strategies

  • Upgrade GeoTools dependencies to versions 33.6, 34.5, or 35.1 immediately.
  • Apply the Principle of Least Privilege to database connection configurations, ensuring the application cannot perform administrative tasks or write to the filesystem.
  • Configure Web Application Firewalls (WAF) to detect and block malicious JSON path patterns or SQL injection payloads in WFS and WMS query strings.

Remediation Steps:

  1. Identify all projects and middleware applications utilizing the GeoTools library (such as GeoServer).
  2. Open the build configuration file (e.g., pom.xml or build.gradle) and locate the geotools dependency definitions.
  3. Update the geotools.version or specific gt-jdbc-postgis artifact versions to 33.6, 34.5, or 35.1.
  4. Rebuild the application, ensuring that transitive dependencies of downstream packages resolve to the patched version.
  5. Execute the test suites and verify that query capabilities function properly without breaking spatial operations.
  6. Redeploy the application to staging and production environments.

References

Read the full report for CVE-2026-76904 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)