CVE-2026-110748: Apache SIS: CWE-22: improper limitation of paths to GML, GeoTIFF, NADCON or NTv2 files

Q: Which inputs can trigger the vulnerable file access behavior?

Affected inputs include GML files containing xlink:href references to other GML files, WKT files that reference NADCON, NTv2, or RGF93 datum-shift grids, and Landsat scenes that reference GeoTIFF files for individual bands.

Q: What does an attacker need to exploit this issue?

An attacker would need to cause Apache SIS to process a supported data file containing references to other files. In affected versions, those references could specify local paths outside the expected directory.

Q: Are all referenced local files likely to be exposed?

No. Apache SIS expects referenced files to use specific formats and stops reading at the first parsing error, making leakage of sensitive information unlikely.

Q: What should be done if upgrading is not immediately possible?

Do not process untrusted GML, WKT, or Landsat scene files that contain external file references. Restrict the directories accessible to the Apache SIS process so referenced paths cannot reach sensitive local files.

Q: How does version 1.7 change the behavior?

Version 1.7 restricts referenced paths to the directory containing the referring file, or to a predetermined directory for datum-shift grids.

Published Oct 26, 2026

Updated

This issue affects Apache SIS from version 0.7 through 1.6 inclusive. When a data file contains links to other files, Apache SIS opened these files regardless their paths. It was possible, for example, to specify a path to a local file. However, these files were always expected to be in some specific formats and the reading stops at the first parsing error, which makes this vulnerability unlikely to leak sensitive information. The impacted formats are:

Geographic Markup Language (GML) with xlink:href attributes for other files in GML format. Well Known Text (WKT) with parameter elements for datum shift grids in NADCON, NTv2 or RGF93 formats. Landsat scene with paths to files for each band in the GeoTIFF format.

Users are recommended to upgrade to version 1.7, which fixes the issue by restricting the paths to the same directory as the file containing the references to other files, or to a predetermined directory for datum shift grids.

Affected Software

1 affected component

Apache SIS>=0.7<=1.6

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Apache SIS to a version that resolves this vulnerability.
Fixed in 1.7

Event History

Oct 26, 2026

CVE Published

via MITRE·02:40 PM

Data Sourced

via MITRE·02:40 PM

DescriptionWeakness

Frequently Asked Questions

Which inputs can trigger the vulnerable file access behavior?

Affected inputs include GML files containing xlink:href references to other GML files, WKT files that reference NADCON, NTv2, or RGF93 datum-shift grids, and Landsat scenes that reference GeoTIFF files for individual bands.

What does an attacker need to exploit this issue?

An attacker would need to cause Apache SIS to process a supported data file containing references to other files. In affected versions, those references could specify local paths outside the expected directory.

Are all referenced local files likely to be exposed?

No. Apache SIS expects referenced files to use specific formats and stops reading at the first parsing error, making leakage of sensitive information unlikely.

What should be done if upgrading is not immediately possible?

Do not process untrusted GML, WKT, or Landsat scene files that contain external file references. Restrict the directories accessible to the Apache SIS process so referenced paths cannot reach sensitive local files.

How does version 1.7 change the behavior?

Version 1.7 restricts referenced paths to the directory containing the referring file, or to a predetermined directory for datum-shift grids.

CVE-2026-110748: Apache SIS: CWE-22: improper limitation of paths to GML, GeoTIFF, NADCON or NTv2 files

Affected Software

Remediation

Event History

Frequently Asked Questions

Which inputs can trigger the vulnerable file access behavior?

What does an attacker need to exploit this issue?

Are all referenced local files likely to be exposed?

What should be done if upgrading is not immediately possible?

How does version 1.7 change the behavior?

Company

Resources

Contact

Frequently Asked Questions

Which inputs can trigger the vulnerable file access behavior?

What does an attacker need to exploit this issue?

Are all referenced local files likely to be exposed?

What should be done if upgrading is not immediately possible?

How does version 1.7 change the behavior?