Apache SIS Patch Blocks XML Attack That Leaks Server Files

The Apache Software Foundation has issued a security advisory for the Apache Spatial Information System (SIS), detailing a newly discovered vulnerability tracked as CVE-2025-68280 that exposes systems to XML External Entity (XXE) attacks and could allow attackers to read sensitive local files from the server.

Rated as Moderate severity, the flaw affects releases from version 0.4 through 1.5, whose analysis shows that an attacker could craft an XML file that when parsed by Apache SIS reveals the content of a local file on the server. The vulnerability stems from an improper restriction of XML External Entity references, a class of flaws that arise when untrusted XML data is processed without disabling external references.

The advisory notes that upgrading to Apache SIS version 1.6 resolves the issue by enforcing stricter XML parsing rules, and provides a workaround for those unable to upgrade: launching Java with the javax.xml.accessExternalDTD system property set to an empty list or a strict whitelist of authorised protocols. The article also lists affected data formats, including GeoTIFF with the GEO_METADATA tag, ISO 19115 metadata in XML, GML-defined coordinate reference systems, and GPX files.