{"uuid": "ada4a6ed-46fa-4b57-8378-e13e9291110d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-76904", "type": "seen", "source": "https://gist.github.com/alon710/5c5c31a44818bfd282b695c164d075db", "content": "# CVE-2026-76904: CVE-2026-76904: Unauthenticated SQL Injection in GeoTools PostGIS DataStore Component\n\n> **CVSS Score:** 9.8\n> **Published:** 2026-08-21\n> **Full Report:** https://cvereports.com/reports/CVE-2026-76904\n\n## Summary\nA critical SQL injection vulnerability exists in the GeoTools open-source Java library. This vulnerability is situated within the post-processing phase of OGC Filter conversion inside the PostGIS DataStore module. Specifically, the `jsonArrayContains` function does not validate or sanitize its arguments before constructing PostgreSQL SQL/JSON path evaluation queries. An unauthenticated remote attacker can exploit this weakness by submitting crafted filters via standard OGC services like WFS or WMS to execute arbitrary SQL commands on the underlying database system.\n\n## TL;DR\nAn unauthenticated SQL injection vulnerability in the GeoTools `jsonArrayContains` OGC filter function allows remote attackers to execute arbitrary database commands and potentially achieve remote code execution by exploiting unsanitized input parsing in PostGIS database queries.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-89\n- **Attack Vector**: Network (AV:N)\n- **CVSS v3.1**: 9.8 (Critical)\n- **Exploit Status**: PoC (Proof of Concept)\n- **Impact**: Unauthenticated SQL Injection & potential Remote Code Execution\n- **Component**: gt-jdbc-postgis (PostGIS DataStore)\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- GeoTools geospatial library\n- GeoServer installations leveraging PostGIS data stores\n- Java-based spatial middleware utilizing gt-jdbc-postgis modules\n- **GeoTools**: >= 30.5, < 33.6 (Fixed in: `33.6`)\n- **GeoTools**: >= 34.0, < 34.5 (Fixed in: `34.5`)\n- **GeoTools**: 35.0 (Fixed in: `35.1`)\n\n## Mitigation\n\n- Upgrade GeoTools dependencies to versions 33.6, 34.5, or 35.1 immediately.\n- Apply the Principle of Least Privilege to database connection configurations, ensuring the application cannot perform administrative tasks or write to the filesystem.\n- Configure Web Application Firewalls (WAF) to detect and block malicious JSON path patterns or SQL injection payloads in WFS and WMS query strings.\n\n**Remediation Steps:**\n1. Identify all projects and middleware applications utilizing the GeoTools library (such as GeoServer).\n2. Open the build configuration file (e.g., pom.xml or build.gradle) and locate the geotools dependency definitions.\n3. Update the `geotools.version` or specific `gt-jdbc-postgis` artifact versions to 33.6, 34.5, or 35.1.\n4. Rebuild the application, ensuring that transitive dependencies of downstream packages resolve to the patched version.\n5. Execute the test suites and verify that query capabilities function properly without breaking spatial operations.\n6. Redeploy the application to staging and production environments.\n\n## References\n\n- [GitHub Security Advisory GHSA-mqjf-5f49-2fjh](https://github.com/geotools/geotools/security/advisories/GHSA-mqjf-5f49-2fjh)\n- [GeoTools Remediation Commit d821c4d321dd91c22e31fcd5b1ce676645da5176](https://github.com/geotools/geotools/commit/d821c4d321dd91c22e31fcd5b1ce676645da5176)\n- [GeoTools Pull Request 5829](https://github.com/geotools/geotools/pull/5829)\n- [GeoTools 33.6 Release Tag](https://github.com/geotools/geotools/releases/tag/33.6)\n- [GeoTools 34.5 Release Tag](https://github.com/geotools/geotools/releases/tag/34.5)\n- [GeoTools 35.1 Release Tag](https://github.com/geotools/geotools/releases/tag/35.1)\n- [OSGeo Bug Tracker GEOT-7589](https://osgeo-org.atlassian.net/browse/GEOT-7589)\n- [OSGeo Bug Tracker GEOT-7958](https://osgeo-org.atlassian.net/browse/GEOT-7958)\n- [OSGeo Bug Tracker GEOT-7959](https://osgeo-org.atlassian.net/browse/GEOT-7959)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-76904) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-22T09:31:53.381135Z"}