Directory Traversal Vulnerability in Apache SIS Affects Multiple Versions

CVE-2026-110748

What is CVE-2026-110748?

Apache SIS versions 0.7 to 1.6 have a vulnerability that allows users to open files linked within data files without proper path validation. This could potentially lead to unauthorized access to files located outside expected directories. The vulnerability primarily affects data formats like Geographic Markup Language (GML), Well Known Text (WKT), and GeoTIFF. To mitigate this issue, upgrading to version 1.7 is recommended, which restricts file paths to enhance security.

References