Unpatched GeoServer Zero-Day SQL Injection in jsonArrayContains (GHSA-mqjf-5f49-2fjh) Enables Unauthenticated RCE via PostGIS — Threadlinqs Intelligence
As of 2026-08-16, Unpatched GeoServer Zero-Day SQL Injection in jsonArrayContains (GHSA-mqjf-5f49-2fjh) Enables Unauthenticated RCE via PostGIS is a critical-severity vulnerability threat, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 12 indicators of compromise.
Threat ID: TL-2026-2035 · Severity: CRITICAL · CVSS: 9.8 · Status: ACTIVE · Category: VULNERABILITY
A zero-day SQL injection in GeoServer's jsonArrayContains OGC filter function (GHSA-mqjf-5f49-2fjh, CVSS 9.8) lets unauthenticated attackers inject arbitrary SQL against PostGIS-backed layers,
GeoServer's jsonArrayContains(<column>, <pointer>, <value>) filter expression, implemented in GeoTools' PostGIS JDBC datastore module (org.geotools:gt-jdbc-postgis), writes the caller-supplied <value> argument directly into generated SQL without escaping. Against a PostGIS 12+ backed layer with a String or JSON field, this lets an unauthenticated remote attacker break out of the intended query string and inject arbitrary SQL through the OGC Filter/CQL_FILTER interface used by WFS GetFeature and related OWS requests. GeoTools' security advisory (GHSA-mqjf-5f49-2fjh, CVSS 9.8, CWE-89) confirms the flaw is a direct regression of CVE-2023-25158 — a 2023 OGC Filter SQL injection in JDBCDataStore implementations — and explicitly notes that CVE-2023-25158's mitigation (enabling prepared statements / disabling encode functions) does not stop this new variant; the advisory further states that setting the JDBC preferQueryMode to extended does not eliminate the raw string-concatenation sink either. The GHSA formally scopes exploitation impact to unauthenticated read, modification, AND deletion of database content (Confidentiality/Integrity/Availability all rated High), not merely disclosure.
Publicly released proof-of-concept code (GitHub repo GeoServer-jsonArrayContains-PG-RCE and an accompanying gist) demonstrates the full exploit chain: a single quote in the injected value breaks the jsonb_path_exists(...) string context, stacked queries are then used to run PostgreSQL's COPY (SELECT 1) TO PROGRAM '<command>', which executes an arbitrary OS command as the database service account. The PoC author notes the attack must be delivered via WFS 2.0 finite-limit/count-style requests specifically — payloads are not interchangeable with WMS GetMap requests, since the two request types traverse different query-building paths with different bracket/alias/trailing-clause structure — and that the PoC intentionally uses local file writes as proof-of-execution markers rather than reverse shells, requiring an explicit --execute flag to prevent accidental live deployment. This RCE path requires the connecting database role to hold the pg_execute_server_program attribute or superuser status — a configuration WatchTowr and others flag as common in default/lower-friction GeoServer-to-PostGIS deployments; the PoC repository explicitly cautions this is not an 'any GeoServer instance can be directly RCE'd' finding. The same stacked-query primitive supports blind boolean/time-based extraction (pg_sleep-based payloads) for reading arbitrary database content even without RCE-level privileges.
The vulnerability was disclosed on X by researcher @q1uf3ng on 2026-08-12 at 10:46 UTC without prior coordination with the GeoServer project, leaving it unpatched with no CVE identifier at disclosure time. WatchTowr (analyst Jake Knott) reported observing hundreds of exploitation/probing attempts against internet-facing GeoServer instances within hours, originating from a small number of source IP addresses; as of the initial wave of reporting (2026-08-13), activity was characterized as reconnaissance — probes triggering database errors to build target lists — with no confirmed follow-on payload delivery or compromise. The GeoServer Project Steering Committee shipped fixed releases (3.0.1, 2.28.5 LTS, 2.27.6) on 2026-08-14, crediting Andrea Aime (GeoSolutions) and Jody Garnett (GeoCat) for the expedited remediation work; the GeoTools GHSA itself (patching gt-jdbc-postgis to 35.1/34.5/33.6), formally published 2026-08-15, separately credits reporters qquang, mrlihd, PhilipPhil, and Quikko — distinct individuals from both the public discloser (@q1uf3ng) and the two developers who implemented the fix, indicating the flaw reached the GeoTools security team through a coordinated report in parallel with (or shortly after) q1uf3ng's public disclosure.
Early secondary reporting was inconsistent on which database backends are affected: SecurityWeek's original report referenced '
Target sectors: government administration, education, agriculture, transport, utilities, engineering, scienceandresearch
Target regions: Global
Timeline
- GeoTools patches CVE-2023-25158 (GHSA-99c3-qc2q-p94m, CVSS 9.8), a prior critical OGC Filter SQL injection in JDBCDataStore implementations (PropertyIsLike/strEndsWith); its 'enable prepared statements / disable encode functions' mitigation guidance is later shown ineffective against the jsonArrayContains regression.
- CVE-2024-36401, a GeoTools unsafe XPath-evaluation RCE (CVSS 9.8), is added to the CISA Known Exploited Vulnerabilities catalog after real-world exploitation of internet-facing GeoServer instances for web shells, DDoS botnets, and cryptomining, including a U.S. federal agency compromise within two weeks of disclosure.
- Researcher @q1uf3ng publicly discloses the GeoServer jsonArrayContains SQL injection on X at 10:46 UTC without coordinated disclosure to the GeoServer project, leaving the flaw unpatched with no CVE assigned.
- WatchTowr begins observing hundreds of exploitation/probing attempts against internet-facing GeoServer instances, originating from a small number of source IP addresses, within hours of public disclosure.
- SecurityWeek, The Hacker News, Security Affairs, Field Effect, and CSO Online publish independent coverage; WatchTowr's Jake Knott characterizes the activity as reconnaissance-stage probing that triggers database errors without confirmed follow-on payload delivery, and warns it will likely escalate.
- The GeoServer Project Steering Committee releases GeoServer 3.0.1, 2.28.5, and 2.27.6 (with Docker images and Windows installers) fixing the flaw, crediting Andrea Aime (GeoSolutions) and Jody Garnett (GeoCat) for the expedited response.
- Public proof-of-concept exploit code (GeoServer-jsonArrayContains-PG-RCE on GitHub, and an accompanying gist) is released demonstrating the full SQLi-to-RCE chain via WFS 2.0 finite-limit/count requests and PostgreSQL's COPY TO PROGRAM.
- GitHub Security Advisory GHSA-mqjf-5f49-2fjh is formally published against org.geotools:gt-jdbc-postgis (CVSS 9.8, CWE-89), confirming patched releases 35.1/34.5/33.6, referencing OSGeo JIRA ticket GEOT-7958, and crediting reporters qquang, mrlihd, PhilipPhil, and Quikko — distinct from public discloser @q1uf3ng.
Detections & IOCs
As of 2026-09-04, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 12 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
VULNERABILITY, CRITICAL, threat intelligence, cybersecurity, T1595.002, T1587.004, T1588.006, T1588.005, T1190, T1059.004, T1213, T1565.001, T1485
