CVE-2026-110748
Low risk· EPSS 5%Exploitation Probability (EPSS)
Low risk5th percentile - higher than 5% of all known CVEs
Summary
Apache SIS from version 0.7 through 1.6 opens files referenced by processed data regardless of their paths, potentially allowing a local file path to be specified. This affects GML with xlink:href attributes, WKT with datum shift grid parameter elements, and Landsat scenes with GeoTIFF band file paths. Reading stops at the first parsing error, making sensitive information leakage unlikely.
Risk Assessment
The risk of sensitive information leakage is low due to format constraints and read termination on error. Nevertheless, uncontrolled local file access may violate security policies.
Recommendation
Update Apache SIS to version 1.7, which restricts paths to the directory of the referencing file or a predetermined datum shift grid directory. Avoid processing untrusted data files until updated.
Other vulnerabilities in Apache SIS
See all- CVE-2026-110733Medium
In the SQL storage module of Apache SIS, when sorting a stream of features, the clause is copied after ORDER BY without quoting the identifier character. A crafted sort clause could inject SQL into the query. This affects the sql-storage module from version 1.0 through 1.6; other modules such as sis-referencing are not impacted.
- CVE-2025-68280Medium
Apache SIS has an XML External Entity (XXE) vulnerability that allows an attacker to disclose local file contents on the server when parsing certain formats (GeoTIFF, ISO 19115, GML, GPX). Affects versions 0.4 through 1.5.
Original NVD description (English source)
This issue affects Apache SIS from version 0.7 through 1.6 inclusive. When a data file contains links to other files, Apache SIS opened these files regardless their paths. It was possible, for example, to specify a path to a local file. However, these files were always expected to be in some specific formats and the reading stops at the first parsing error, which makes this vulnerability unlikely to leak sensitive information. The impacted formats are: * Geographic Markup Language (GML) with `xlink:href` attributes for other files in GML format. * Well Known Text (WKT) with parameter elements for datum shift grids in NADCON, NTv2 or RGF93 formats. * Landsat scene with paths to files for each band in the GeoTIFF format. Users are recommended to upgrade to version 1.7, which fixes the issue by restricting the paths to the same directory as the file containing the references to other files, or to a predetermined directory for datum shift grids.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS