Read the docs
TI-2023-10620 Aliases CVE-2023-25158GHSA-99c3-qc2q-p94m

Unfiltered SQL Injection in Geotools

Priority MEDIUM 51CWE-89Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
SQL injection
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-89.

Summary

GeoTools is an open source Java library that provides tools for geospatial data. GeoTools includes support for OGC Filter expression language parsing, encoding and execution against a range of datastore. SQL Injection Vulnerabilities have been found when executing OGC Filters with JDBCDataStore implementations. Users are advised to upgrade to either version 27.4 or to 28.2 to resolve this issue. Users unable to upgrade may disable `encode functions` for PostGIS DataStores or enable `prepared statements` for JDBCDataStores as a partial mitigation.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01095 65th percentileScored 2026-11-07
Fix Fixed geotools (geotools): 28.2, 27.4org.geotools:gt-jdbc (Maven): 28.2, 27.4, 26.7 +2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
geotoolsgeotools28.0 to before 28.2; before 27.428.2, 27.4Patch availableCNA
—org.geotools:gt-jdbc (Maven)28.0 to before 28.228.2Patch availableGHSA-99c3-qc2q-p94m
—org.geotools:gt-jdbc (Maven)27.0 to before 27.427.4Patch availableGHSA-99c3-qc2q-p94m
—org.geotools:gt-jdbc (Maven)26.0 to before 26.726.7Patch availableGHSA-99c3-qc2q-p94m
—org.geotools:gt-jdbc (Maven)25.0 to before 25.725.7Patch availableGHSA-99c3-qc2q-p94m
—org.geotools:gt-jdbc (Maven)before 24.724.7Patch availableGHSA-99c3-qc2q-p94m
  • geotools Vendorgeotools Affected 28.0 to before 28.2; before 27.4 Fixed in 28.2, 27.4 Patch available CNA
  • org.geotools:gt-jdbc (Maven) Vendor— Affected 28.0 to before 28.2 Fixed in 28.2 Patch available GHSA-99c3-qc2q-p94m
  • org.geotools:gt-jdbc (Maven) Vendor— Affected 27.0 to before 27.4 Fixed in 27.4 Patch available GHSA-99c3-qc2q-p94m
  • org.geotools:gt-jdbc (Maven) Vendor— Affected 26.0 to before 26.7 Fixed in 26.7 Patch available GHSA-99c3-qc2q-p94m
  • org.geotools:gt-jdbc (Maven) Vendor— Affected 25.0 to before 25.7 Fixed in 25.7 Patch available GHSA-99c3-qc2q-p94m
  • org.geotools:gt-jdbc (Maven) Vendor— Affected before 24.7 Fixed in 24.7 Patch available GHSA-99c3-qc2q-p94m

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:geotools:geotools:*:*:*:*:*:*:*:*before 24.7; 25.0 to before 25.7; 26.0 to before 26.7; 27.0 to before 27.4; 28.0 to before 28.2Vulnerablegeotools
  • cpe:2.3:a:geotools:geotools:*:*:*:*:*:*:*:* Versions before 24.7; 25.0 to before 25.7; 26.0 to before 26.7; 27.0 to before 27.4; 28.0 to before 28.2 Vulnerable ·geotools

Remediation

  • Fix · CNA geotools (geotools) Fixed in 28.2, 27.4
  • Fix · GHSA-99c3-qc2q-p94m org.geotools:gt-jdbc (Maven) Fixed in 28.2 Advisory →
  • Fix · GHSA-99c3-qc2q-p94m org.geotools:gt-jdbc (Maven) Fixed in 27.4 Advisory →
  • Fix · GHSA-99c3-qc2q-p94m org.geotools:gt-jdbc (Maven) Fixed in 26.7 Advisory →
  • Fix · GHSA-99c3-qc2q-p94m org.geotools:gt-jdbc (Maven) Fixed in 25.7 Advisory →
  • Fix · GHSA-99c3-qc2q-p94m org.geotools:gt-jdbc (Maven) Fixed in 24.7 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-25158
  2. 2026-10-03 Alias added: GHSA-99c3-qc2q-p94m

References

Patch 1

Advisory 2

Other 1

  • TI-2024-24187 Remote Code Execution (RCE) vulnerability in evaluating property name expressions in Geoserver KEVCVSS 3.1CRITICAL 9.8
  • TI-2025-21556 GeoTools, GeoServer, and GeoNetwork XML External Entity (XXE) Processing Vulnerability in XSD schema handling CVSS 3.1CRITICAL 9.9
  • TI-2022-08631 Unchecked JNDI lookups in GeoTools CVSS 3.1HIGH 8.2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences