Live › vulnerability › CVE-2026-110748
Go to dashboardApache SIS, a Java library for geospatial data, follows file links inside GML, WKT and Landsat data files without restricting their paths. A crafted data file can make the reader open any local file, though the parser usually stops at the first format error, so leaked content is unlikely.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-26 16:02 UTC. All times on this page are UTC.
Applications that parse GML, WKT datum shift definitions, or Landsat scene metadata with Apache SIS from version 0.7 through 1.6, especially when the input comes from users or other untrusted sources. Teams that only process their own trusted data files or do not use these formats can skip it.
No product ranges from the sources yet.
pom.xml or build.gradle) and confirm whether it is between 0.7 and 1.6.1.7, which restricts referenced paths to the directory of the source file or a predetermined grid directory.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
This issue affects Apache SIS from version 0.7 through 1.6 inclusive. When a data file contains links to other files, Apache SIS opened these files regardless their paths. It was possible, for example, to specify a path to a local file. However, these files were always expected to be in some specific formats and the reading stops at the first parsing error, which makes this vulnerability unlikely to leak sensitive information. The impacted formats are:
xlink:href attributes for other files in GML format.Users are recommended to upgrade to version 1.7, which fixes the issue by restricting the paths to the same directory as the file containing the references to other files, or to a predetermined directory for datum shift grids.
This page as .md · .json · in your agent: get_signal("CVE-2026-110748")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.