Description

GeoTools is an open source Java library that provides tools for geospatial data. Starting in version 30.5 and prior to versions 33.6, 34.5, and 33.6, an SQL Injection Vulnerability is present when executing OGC Filters with PostGIS DataStore implementation: `jsonArrayContains` function; Requires PostGIS 12 or greater with a String or JSON field. For PostGIS 12 and greater `jsonArrayContains(<column>, <pointer>, <value>)` function writes `<value>` into generated SQL without escaping. Patches are available in versions 33.6, 34.5, and 33.6. No known workaround is available. To limit scope of SQL Injection the PostGIS connection pool should be configured with limited rights.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-08-21T21:17:06.143Z",
  "pubdate": "2026-08-21T21:17:06.143Z",
  "executiveSummary": "An SQL injection vulnerability exists in the GeoTools open source Java library, specifically within the PostGIS DataStore implementation when processing OGC Filters utilizing the jsonArrayContains function. The flaw arises from improper input sanitization, allowing malicious values to be written directly into generated SQL statements without escaping when interacting with PostGIS 12 or greater databases containing String or JSON fields.\nSuccessful exploitation of this vulnerability permits unauthorized attackers to execute arbitrary SQL commands against the underlying database, potentially leading to data exfiltration, data manipulation, or unauthorized database access. The impact depends heavily on the privilege level of the database connection pool used by the application.\nAffected products include GeoTools versions starting from 30.5 and prior to 33.6 and 34.5. The vulnerability requires the target system to run PostGIS 12 or greater and execute OGC Filters that leverage the vulnerable jsonArrayContains function. Currently, no known workarounds exist to neutralize the flaw directly within the library logic.\nTo limit the scope of potential SQL injection exploitation, organizations are advised to apply official patches and configure the PostGIS database connection pool with restricted user privileges adhering to the principle of least privilege.",
  "technicalDetails": "The root cause of the vulnerability resides in the PostGIS DataStore implementation of the GeoTools library when handling OGC Filters containing the jsonArrayContains function. Specifically, for database environments running PostGIS 12 or greater, the function jsonArrayContains(<column>, <pointer>, <value>) fails to properly escape or sanitize the provided <value> parameter before incorporating it into the dynamically constructed SQL query string.\nThe vulnerable component is the OGC Filter translation mechanism within the PostGIS DataStore module, which processes spatial and attribute queries against String or JSON database fields. Affected software versions include GeoTools starting from version 30.5 and prior to versions 33.6 and 34.5.\nThe attack flow initiates when an external entity submits a crafted OGC Filter query containing malicious SQL syntax targeted at the jsonArrayContains function. Because the library interpolates the <value> parameter directly into the SQL statement without escaping, the database query parser interprets the injected payload as native SQL commands rather than literal data.\nDepending on the exact vector and context of the injected payload, an attacker can manipulate the query logic, bypass authentication or authorization checks implemented at the query level, extract sensitive data from other database tables via union-based or boolean-based techniques, or execute administrative operations if the database connection possesses excessive privileges.\nExploitation requirements include network exposure of the application utilizing GeoTools to untrusted input sources, the presence of PostGIS 12 or greater, and the execution of queries utilizing the vulnerable jsonArrayContains function against String or JSON fields. Authentication and privilege requirements for the attacker depend on the application-layer access controls guarding the GeoTools OGC Filter ingestion endpoints."
}