Apache SIS vulnerabilities

Apache SIS from version 0.7 through 1.6 opens files referenced by processed data regardless of their paths, potentially allowing a local file path to be specified. This affects GML with xlink:href attributes, WKT with datum shift grid parameter elements, and Landsat scenes with GeoTIFF band file paths. Reading stops at the first parsing error, making sensitive information leakage unlikely.

In the SQL storage module of Apache SIS, when sorting a stream of features, the clause is copied after ORDER BY without quoting the identifier character. A crafted sort clause could inject SQL into the query. This affects the sql-storage module from version 1.0 through 1.6; other modules such as sis-referencing are not impacted.

Apache SIS has an XML External Entity (XXE) vulnerability that allows an attacker to disclose local file contents on the server when parsing certain formats (GeoTIFF, ISO 19115, GML, GPX). Affects versions 0.4 through 1.5.