CVE-2025-68280

CVE-2025-68280 affects Apache SIS versions 0.4–1.5. The issue is an improper restriction of XML External Entity (XXE) references, allowing an XML document to disclose content from the server’s local filesystem when parsed by SIS. Impacted services include reading GeoTIFFs with the GEO_METADATA ta...