Executive brief
GeoTools is a widely-used open-source Java library for geospatial data processing and mapping. The jsonArrayContains filter function in its PostGIS connector allows unauthenticated attackers to execute arbitrary SQL commands against the database by injecting unescaped payloads. This could lead to complete compromise of the PostGIS database, including unauthorized access to all stored geographic and related data, modification or deletion of records, and potential lateral movement into connected systems.
Technical details
The vulnerability is a classic SQL injection (CWE-89) in the jsonArrayContains OGC filter implementation for PostGIS DataStore. When the jsonArrayContains(<column>, <pointer>, <value>) function constructs SQL queries, the <value> parameter is concatenated into the SQL without parameterized queries or proper escaping, allowing an attacker to inject SQL syntax. The attack vector is network-based with no authentication required, no special privileges, and no user interaction needed. An attacker can exploit this by submitting a crafted OGC filter request to any GeoTools service exposing PostGIS layers. Successful exploitation grants full SQL execution capabilities within the database's permission scope. Patches are available in GeoTools 33.6, 34.5, and 35.1. Mitigation is limited to restricting PostGIS database user permissions.
Affected products
- OSGeo GeoTools 30.5 through 33.5, 34.0 through 34.4, 35.0
Timeline
- 2026-08-21: disclosed: Advisory published on GitHub
- 2026-08-21: patched: GeoTools 33.6, 34.5, and 35.1 released with fixes