PT-2026-80293 · Maven · Org.Geotools.Jdbc:Gt-Jdbc-Postgis

Publicado

2026-08-21

·

Atualizado

2026-08-21

CVSS v3.1

9.8

Crítica

VetorAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Summary

An SQL Injection Vulnerability has been found when executing OGC Filters with PostGIS DataStore implementation:
  • jsonArrayContains function Requires PostGIS 12 or greater with a String or JSON field
For PostGIS 12 and greater jsonArrayContains(<column>, <pointer>, <value>) function writes <value> into generated SQL without escaping.

Patches

  • GeoTools 35.1
  • GeoTools 33.5
  • GeoTools 34.4

Mitigation

No mitigation is available:
  • To limit scope of SQL Injection the PostGIS connection pool should be configured with limited rights.

Impact

This vulnerability can lead to execution of arbitrary SQL expressions in the database.

References

Correção

SQL injection

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

GHSA-MQJF-5F49-2FJH

Produtos afetados

Org.Geotools.Jdbc:Gt-Jdbc-Postgis