{"id":"CVE-2026-110748","kind":"vulnerability","aliases":["CVE-2026-110748"],"related":[],"title":"Apache SIS: data files can open arbitrary local file paths","description":"This issue affects Apache SIS from version 0.7 through 1.6 inclusive. When a data file contains links to other files, Apache SIS opened these files regardless their paths. It was possible, for example, to specify a path to a local file. However, these files were always expected to be in some specific formats and the reading stops at the first parsing error, which makes this vulnerability unlikely to leak sensitive information. The impacted formats are:\n\n  *  Geographic Markup Language (GML) with `xlink:href` attributes for other files in GML format.\n  *  Well Known Text (WKT) with parameter elements for datum shift grids in NADCON, NTv2 or RGF93 formats.\n  *  Landsat scene with paths to files for each band in the GeoTIFF format.\n\n\n\n\nUsers are recommended to upgrade to version 1.7, which fixes the issue by restricting the paths to the same directory as the file containing the references to other files, or to a predetermined directory for datum shift grids.","summary":"Apache SIS, a Java library for geospatial data, follows file links inside GML, WKT and Landsat data files without restricting their paths. A crafted data file can make the reader open any local file, though the parser usually stops at the first format error, so leaked content is unlikely.","severity":"low","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["apache-sis","geospatial","java","package"],"not_affected_if":["trusted-input-only","unused-gml-wkt-landsat"],"how_to_check":"- Check the Apache SIS version in the project build file (for example `pom.xml` or `build.gradle`) and confirm whether it is between `0.7` and `1.6`.\n- Look for code that reads untrusted GML, WKT with datum shift grids, or Landsat scenes with Apache SIS.","fix":"- Upgrade Apache SIS to `1.7`, which restricts referenced paths to the directory of the source file or a predetermined grid directory.","status":"open","published_at":"2026-10-26T15:16:36+00:00","first_seen_at":"2026-10-26T16:02:25+00:00","triaged_at":"2026-10-26T16:04:15+00:00","updated_at":"2026-10-26T16:04:15+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-26T16:04:15Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Apache SIS to `1.7`, which restricts referenced paths to the directory of the source file or a predetermined grid directory.","reach":"unknown","title":"Apache SIS: data files can open arbitrary local file paths","impact":"low","summary":"Apache SIS, a Java library for geospatial data, follows file links inside GML, WKT and Landsat data files without restricting their paths. A crafted data file can make the reader open any local file, though the parser usually stops at the first format error, so leaked content is unlikely.","category":"package","nicknames":[],"who_cares":["java","apache-sis","geospatial"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Local files can be opened, with limited content exposure.","analyst_note":"","how_to_check":"- Check the Apache SIS version in the project build file (for example `pom.xml` or `build.gradle`) and confirm whether it is between `0.7` and `1.6`.\n- Look for code that reads untrusted GML, WKT with datum shift grids, or Landsat scenes with Apache SIS.","needs_analyst":false,"not_affected_if":["trusted-input-only","unused-gml-wkt-landsat"],"who_is_affected":"Applications that parse GML, WKT datum shift definitions, or Landsat scene metadata with Apache SIS from version 0.7 through 1.6, especially when the input comes from users or other untrusted sources. Teams that only process their own trusted data files or do not use these formats can skip it.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.00063,"input_tokens":3514,"output_tokens":558,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-110748':13A,16A '-2026':12A,15A '0.7':79C '1.6':81C '1.7':198C 'affect':74C 'alway':117C 'apach':1A,18B,23B,75C,92C 'apache-si':17B 'arbitrari':7A 'attribut':154C 'band':186C 'contain':87C,214C 'content':69B 'craft':46B 'cve':11A,14A 'data':3A,30B,39B,47B,85C 'datum':169C,226C 'directori':210C,224C 'element':167C 'error':66B,133C 'exampl':104C 'expect':118C 'file':4A,9A,32B,40B,48B,56B,86C,91C,96C,112C,115C,157C,183C,213C,219C 'first':64B,131C 'fix':200C 'follow':31B 'format':65B,124C,145C,160C,177C,190C 'geograph':147C 'geospati':20B,29B 'geotiff':189C 'gml':35B,150C,159C 'grid':171C,228C 'howev':113C 'href':153C 'impact':144C 'inclus':82C 'inform':142C 'insid':34B 'issu':73C,202C 'java':21B,26B 'known':162C 'landsat':38B,178C 'languag':149C 'leak':68B,140C 'librari':27B 'link':33B,88C 'local':8A,55B,111C 'make':50B,135C 'markup':148C 'nadcon':173C 'ntv2':174C 'open':6A,53B,94C 'packag':22B 'paramet':166C 'pars':132C 'parser':59B 'path':10A,44B,99C,108C,181C,206C 'possibl':102C 'predetermin':223C 'read':127C 'reader':52B 'recommend':193C 'refer':216C 'regardless':97C 'restrict':42B,204C 'rgf93':176C 'scene':179C 'sensit':141C 'shift':170C,227C 'sis':2A,19B,24B,76C,93C 'specif':123C 'specifi':106C 'stop':61B,128C 'text':163C 'though':57B 'unlik':71B,138C 'upgrad':195C 'user':191C 'usual':60B 'version':78C,197C 'vulner':137C 'well':161C 'without':41B 'wkt':36B,164C 'xlink':152C","nicknames":[],"mitigations":[],"who_affected":"Applications that parse GML, WKT datum shift definitions, or Landsat scene metadata with Apache SIS from version 0.7 through 1.6, especially when the input comes from users or other untrusted sources. Teams that only process their own trusted data files or do not use these formats can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T15:16:36+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-110748","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110748","severity":null,"published_at":"2026-10-26T15:16:36+00:00","modified_at":"2026-10-26T15:16:36+00:00","first_seen_at":"2026-10-26T16:02:25+00:00","fetched_at":"2026-10-26T16:02:25+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}