Apache SIS EUVD-2026-109943

Requires a victim to process an attacker-controlled data file using Apache SIS 0.7-1.6 in one of the affected parsing paths: GML containing xlink:href attributes referencing other GML files, WKT containing parameter elements for NADCON/NTv2/RGF93 datum-shift grids, or a Landsat scene referencing per-band GeoTIFF files. The crafted file must embed a reference to an out-of-scope local path. Exploitation is strongly limited because the referenced target must be in the expected geospatial format and reading stops at the first parsing error, so Apache rates sensitive-data leakage as unlikely; it also depends on the application ingesting untrusted geospatial data, which does not occur in default/trusted-input workflows.

This is a low-priority issue despite the absence of a vendor CVSS score. The input provides no CVSS vector, no EPSS probability, no CISA KEV listing, and no public exploit reference, and the vuln.today Decision label is 'monitor' - a consistent set of signals all pointing to low real-world urgency. The flaw is a path-traversal / external-file-reference issue (CWE-22) in which Apache SIS (0.7 through 1.6) follows file references embedded in geospatial data files without restricting their location, allowing a crafted data file to point to a local file path. Critically, Apache itself notes the impact is self-limiting: a referenced file must conform to a specific expected format (GML, NADCON/NTv2/RGF93 grids, or GeoTIFF) and parsing stops at the first error, so the vendor assesses sensitive-information leakage as 'unlikely.' Because no CVSS vector is supplied, authentication requirements are not confirmed from available data and must not be inferred from the description text. Exploitation is also not autonomous - it requires a victim application to process an attacker-supplied data file. No signals conflict here; all available data agrees this is a defense-in-depth fix rather than an actively pressing threat.

An attacker crafts a malicious GML, WKT, or Landsat scene file whose embedded references (xlink:href, datum-shift grid parameters, or GeoTIFF band paths) point to a local file path outside the intended directory, then gets a victim application using Apache SIS to open it. SIS follows the reference and attempts to read the targeted file, though parsing halts at the first format error, limiting what can be extracted. No public exploit identified at time of analysis.