org.apache.sis:sis-metadata vulnerabilities

CVEs whose affected-version data names the org.apache.sis:sis-metadata package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

1 CVERSS

CVE-2026-110748None

yesterday

Apache SIS: CWE-22: improper limitation of paths to GML, GeoTIFF, NADCON or NTv2 files

This issue affects Apache SIS from version 0.7 through 1.6 inclusive. When a data file contains links to other files, Apache SIS opened these files regardless their paths. It was possible, for example, to specify a path to a local file. …

▾ SunlitApache Software Foundation · org.apache.sis:sis-metadataEPSS 0.16%via CVEORG