GeoTools has unauthenticated SQL injection in the jsonArrayContains filter function against PostGIS layers
### Summary An SQL Injection Vulnerability has been found when executing OGC Filters with PostGIS DataStore implementation: * `jsonArrayContains` function Requires PostGIS 12 or greater with a String or JSON field For PostGIS 12 and greater `jsonArrayContains(<column>, <pointer>, <value>)` function writes `<value>` into generated SQL without escaping. ### Patches * GeoTools 35.1 * GeoTools 33.5 * GeoTools 34.4 ### Mitigation No mitigation is available: * To limit scope of SQL Injection the PostGIS connection pool should be configured with limited rights. ### Impact This vulnerability can lead to execution of arbitrary SQL expressions in the database. ### References * https://osgeo-org.atlassian.net/browse/GEOT-7958 * https://osgeo-org.atlassian.net/browse/GEOT-7959 * https://github.com/geotools/geotools/pull/5829 * https://osgeo-org.atlassian.net/browse/GEOT-7589
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-76904US | — | Exploit | ||
GeoTools is an open source Java library that provides tools for geospatial data. Starting in version 30.5 and prior to versions 33.6, 34.5, and 33.6, an SQL Injection Vulnerability… | ||||
references
External citations — patches, advisories, analysis.
- https://github.com/geotools/geotoolsPACKAGE
- https://github.com/geotools/geotools/commit/d821c4d321dd91c22e31fcd5b1ce676645da5176WEB
- https://github.com/geotools/geotools/pull/5829WEB
- https://github.com/geotools/geotools/releases/tag/33.6WEB
- https://github.com/geotools/geotools/releases/tag/34.5WEB
- https://github.com/geotools/geotools/releases/tag/35.1WEB
- https://github.com/geotools/geotools/security/advisories/GHSA-mqjf-5f49-2fjhWEB
- https://osgeo-org.atlassian.net/browse/GEOT-7589WEB
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan