CVE-2025-68280 - Apache SIS: XML External Entity (XXE) vulnerability

Back Back to CVE browser

MEDIUM

Apache SIS: XML External Entity (XXE) vulnerability

Published Jan 5, 2026

6.5

MEDIUM

CVSS 3.1

EPSS 0.70%

Description

Improper Restriction of XML External Entity Reference vulnerability in Apache SIS.

It is possible to write XML files in such a way that, when parsed by Apache SIS, an XML file reveals to the attacker the content of a local file on the server running Apache SIS. This vulnerability impacts the following SIS services:

* Reading of GeoTIFF files having the GEO_METADATA tag defined by the Defense Geospatial Information Working Group (DGIWG).

* Parsing of ISO 19115 metadata in XML format.

* Parsing of Coordinate Reference Systems defined in the GML format.

* Parsing of files in GPS Exchange Format (GPX).

This issue affects Apache SIS from versions 0.4 through 1.5 inclusive. Users are recommended to upgrade to version 1.6, which will fix the issue. In the meantime, the security vulnerability can be avoided by launching Java with the javax.xml.accessExternalDTD system property sets to a comma-separated list of authorized protocols. For example:

java -Djavax.xml.accessExternalDTD="" ...

Affected products

Vendor Apache Software Foundation Product Apache SIS Default
unaffected
- Version
  0.4
  Status
  affected
  Constraints
  <=1.5

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Apache Software Foundation

Apache SIS

unaffected

Version	Status	Constraints
0.4	affected	<=1.5

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-611

XXE

References (5)

http://www.openwall.com/lists/oss-security/2026/01/05/11
Mailing ListThird Party Advisory
http://www.openwall.com/lists/oss-security/2026/01/05/7
Mailing ListThird Party Advisory
https://github.com/advisories/GHSA-jqmr-2pg9-vfx7
Advisory
https://lists.apache.org/thread/s4ggy3zbtrrn93glgo2vn52lgcxk4bp4
vendor-advisoryMailing ListVendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2025-68280

Link	Providers	Tags
http://www.openwall.com/lists/oss-security/2026/01/05/11		Mailing ListThird Party Advisory
http://www.openwall.com/lists/oss-security/2026/01/05/7		Mailing ListThird Party Advisory
https://github.com/advisories/GHSA-jqmr-2pg9-vfx7		Advisory
https://lists.apache.org/thread/s4ggy3zbtrrn93glgo2vn52lgcxk4bp4		vendor-advisoryMailing ListVendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2025-68280