CVE-2026-110748 in SIS
Summary
by MITRE • 10/26/2026
This issue affects Apache SIS from version 0.7 through 1.6 inclusive. When a data file contains links to other files, Apache SIS opened these files regardless their paths. It was possible, for example, to specify a path to a local file. However, these files were always expected to be in some specific formats and the reading stops at the first parsing error, which makes this vulnerability unlikely to leak sensitive information. The impacted formats are:
* Geographic Markup Language (GML) with `xlink:href` attributes for other files in GML format. * Well Known Text (WKT) with parameter elements for datum shift grids in NADCON, NTv2 or RGF93 formats. * Landsat scene with paths to files for each band in the GeoTIFF format.
Users are recommended to upgrade to version 1.7, which fixes the issue by restricting the paths to the same directory as the file containing the references to other files, or to a predetermined directory for datum shift grids.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/26/2026
The vulnerability identified in Apache SIS versions ranging from 0.7 through 1.6 represents a significant flaw in how the library handles external resource resolution within geospatial data formats. This issue is classified as an Arbitrary File Read or Path Traversal vulnerability, aligning with CWE-22: Improper Limitation of a Pathname to a Restricted Directory. The core technical failure lies in the absence of strict path validation when Apache SIS processes files that contain references to other external resources. Specifically, the library does not adequately sanitize or restrict file paths specified within certain geospatial data structures, allowing an attacker to specify absolute local filesystem paths rather than relative ones confined to the expected directory structure. This behavior violates the principle of least privilege and secure default configurations, as it grants the application broader access to the underlying operating system's file system than intended by its design specifications.
The operational impact of this vulnerability is contingent upon the specific data formats processed by Apache SIS. The affected formats include Geographic Markup Language (GML) files utilizing xlink:href attributes for referencing other GML resources, Well Known Text (WKT) files containing parameter elements that point to datum shift grids in NADCON, NTv2, or RGF93 formats, and Landsat scene data specifying paths to band files within the GeoTIFF format. In a typical scenario involving these formats, an attacker could craft a malicious input file where the reference attribute points to sensitive local files such as configuration files, private keys, or other confidential documents stored on the server hosting the application. However, the practical exploitation of this vulnerability is significantly constrained by the parsing behavior of Apache SIS. The library attempts to read and parse these referenced files expecting them to conform to specific geospatial data structures. If a referenced file does not match the expected format for that context, the parser encounters a syntax or structure error and terminates processing immediately. This strict validation during the reading phase acts as an unintentional but effective mitigation against information leakage in many cases, as it prevents the application from successfully extracting and returning arbitrary content to the attacker unless the target file happens to mimic the required geospatial format closely enough to pass initial parsing checks.
From a threat modeling perspective, this vulnerability maps to MITRE ATT&CK technique T1083: File and Directory Discovery, specifically when used in conjunction with data exfiltration methods that rely on application-level errors or side-channel information leakage. While the likelihood of successful exploitation is reduced due to the format-specific parsing constraints, the risk remains non-zero for attackers who can control both the input file structure and potentially influence the server's filesystem layout to include files that might accidentally resemble valid geospatial data fragments. Furthermore, in environments where Apache SIS is integrated into larger web applications or APIs, a successful exploit could lead to unauthorized access to sensitive system information, contributing to broader security compromises such as privilege escalation if combined with other vulnerabilities like remote code execution via deserialization flaws often found in complex Java libraries.
To mitigate this vulnerability and ensure the integrity of geospatial data processing pipelines, users are strongly advised to upgrade Apache SIS to version 1.7 or later. This release addresses the root cause by implementing strict path restrictions that limit file access exclusively to the same directory as the source file containing the references, or to a predetermined whitelist of directories for datum shift grids. This fix enforces a secure default behavior where external resource resolution is confined within expected boundaries, effectively neutralizing path traversal attacks. For organizations unable to upgrade immediately due to legacy system constraints, alternative mitigations include implementing input validation at the application layer to reject absolute paths before they reach Apache SIS, deploying web application firewalls with rules targeting suspicious file access patterns in geospatial endpoints, and ensuring that the service account running Apache SIS operates under a restricted user profile with minimal filesystem permissions. Regular security audits of data ingestion workflows should also be conducted to identify any custom implementations that might bypass these library-level protections by directly manipulating input streams or paths prior to processing.