PT-2026-80293 · Maven · Org.Geotools.Jdbc:Gt-Jdbc-Postgis

Published

2026-08-21

·

Updated

2026-08-21

CVSS v3.1

9.8

Critical

VectorAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Summary

An SQL Injection Vulnerability has been found when executing OGC Filters with PostGIS DataStore implementation:
  • jsonArrayContains function Requires PostGIS 12 or greater with a String or JSON field
For PostGIS 12 and greater jsonArrayContains(<column>, <pointer>, <value>) function writes <value> into generated SQL without escaping.

Patches

  • GeoTools 35.1
  • GeoTools 33.5
  • GeoTools 34.4

Mitigation

No mitigation is available:
  • To limit scope of SQL Injection the PostGIS connection pool should be configured with limited rights.

Impact

This vulnerability can lead to execution of arbitrary SQL expressions in the database.

References

Fix

SQL injection

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-89

Related Identifiers

GHSA-MQJF-5F49-2FJH

Affected Products

Org.Geotools.Jdbc:Gt-Jdbc-Postgis