Apache Sis
Monthly
Path traversal in Apache SIS 0.7 through 1.6 allows a crafted geospatial data file to make the library open local files referenced through embedded links, regardless of where those files reside. Victims are affected only when they feed untrusted data into one of three parsing paths - GML with xlink:href attributes, WKT with NADCON/NTv2/RGF93 datum-shift grid parameters, or a Landsat scene pointing at per-band GeoTIFF files - and the exposed impact is limited to low confidentiality loss because the target must still match an expected geospatial format and parsing aborts at the first error. No CISA KEV listing or public exploit code was identified at time of analysis, and the vendor rates sensitive-information leakage as unlikely; the fix is Apache SIS 1.7, which confines references to the referencing file's directory or a predetermined grid directory.
SQL injection in Apache SIS's sql-storage module (versions 1.0 through 1.6) allows remote attackers to inject SQL through a crafted sort clause that is copied after ORDER BY without identifier quoting. Exploitation requires an application built on Apache SIS to use the sql-storage module and to derive the ORDER BY sort-clause identifier from attacker-controllable input; reachability is the key limiting factor. Other modules such as sis-referencing are not affected, and no public exploit identified at time of analysis.
Path traversal in Apache SIS 0.7 through 1.6 allows a crafted geospatial data file to make the library open local files referenced through embedded links, regardless of where those files reside. Victims are affected only when they feed untrusted data into one of three parsing paths - GML with xlink:href attributes, WKT with NADCON/NTv2/RGF93 datum-shift grid parameters, or a Landsat scene pointing at per-band GeoTIFF files - and the exposed impact is limited to low confidentiality loss because the target must still match an expected geospatial format and parsing aborts at the first error. No CISA KEV listing or public exploit code was identified at time of analysis, and the vendor rates sensitive-information leakage as unlikely; the fix is Apache SIS 1.7, which confines references to the referencing file's directory or a predetermined grid directory.
SQL injection in Apache SIS's sql-storage module (versions 1.0 through 1.6) allows remote attackers to inject SQL through a crafted sort clause that is copied after ORDER BY without identifier quoting. Exploitation requires an application built on Apache SIS to use the sql-storage module and to derive the ORDER BY sort-clause identifier from attacker-controllable input; reachability is the key limiting factor. Other modules such as sis-referencing are not affected, and no public exploit identified at time of analysis.