dbcve.org
Spatial Information SystemApplication · Apache

CVE-2025-68280

MEDIUM · 6.5 CVSS v3.1 Published 2026-01-05
Fix available
A fix is available. Upgrade to after 1.5 or later.
See remediation →
72/100
Remediation priority · Elevated
Remotely reachable No privileges

Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.

NVD · unedited
Improper Restriction of XML External Entity Reference vulnerability in Apache SIS. It is possible to write XML files in such a way that, when parsed by Apache SIS, an XML file reveals to the attacker the content of a local file on the server running Apache SIS. This vulnerability impacts the following SIS services: * Reading of GeoTIFF files having the GEO_METADATA tag defined by the Defense Geospatial Information Working Group (DGIWG). * Parsing of ISO 19115 metadata in XML format. * Parsing of Coordinate Reference Systems defined in the GML format. * Parsing of files in GPS Exchange Format (GPX). This issue affects Apache SIS from versions 0.4 through 1.5 inclusive. Users are recommended to upgrade to version 1.6, which will fix the issue. In the meantime, the security vulnerability can be avoided by launching Java with the javax.xml.accessExternalDTD system property sets to a comma-separated list of authorized protocols. For example: java -Djavax.xml.accessExternalDTD="" ...

Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.

dbcve analysis · high confidence

This is an XML External Entity (XXE) injection vulnerability in Apache SIS where malicious XML files can be crafted to reveal local server files when parsed. The vulnerability affects four parsing functions: GeoTIFF GEO_METADATA tag reading, ISO 19115 XML metadata parsing, GML Coordinate Reference System parsing, and GPX file parsing. Attackers exploit unvalidated external entity references in XML input to access filesystem contents.

MitigationUpgrade Apache SIS to version 1.6, or temporarily mitigate by launching Java with `-Djavax.xml.accessExternalDTD=""` to disable external DTD access.

Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.

Affected products & versions What the vendor confirmedThe version ranges the vendor confirmed as vulnerable. If your version sits inside a range here, treat yourself as exposed until you have upgraded.

NVD · CPE data
Spatial Information SystemApplication
Affected:>= 0.4, <= 1.5

CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.

From the vector
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.

dbcve checks

Work through these to decide whether this CVE applies to you.

  1. Identify Apache SIS version
    Check the JAR manifest or classpath for org.apache.sis.version (for Apache SIS 0.8+), or locate the sis-core JAR and check its filename which contains the version number. Alternatively, run: java -cp sis-core-*.jar org.apache.sis.internal.main.Version 2>/dev/null || jar tf sis-core-*.jar | grep -i version
    Affected if The installed version is between 0.4 and 1.5 inclusive (e.g., 0.4, 0.5, 0.6, 0.7, 0.8, 0.9, 1.0, 1.1, 1.2, 1.3, 1.4, or 1.5)
  2. Check for GeoTIFF parsing usage
    Search application code or configuration files for imports of org.apache.sis.metadata.iso.implementation.GeoTIFFMetadataReader or any code that reads GeoTIFF files using the GEO_METADATA tag, or inspect any data pipelines that ingest GeoTIFF images
    Affected if The application reads GeoTIFF files and processes the GEO_METADATA tag with untrusted input
  3. Check for ISO 19115 XML parsing usage
    Search for usage of org.apache.sis.xml.MarshallerPool or any ISO 19115 metadata parsing code (classes in org.apache.sis.metadata.iso.*) that handles XML input from external sources
    Affected if The application parses ISO 19115 XML metadata from untrusted sources
  4. Check for GML CRS parsing usage
    Search for code using org.apache.sis.referencing.CRS.fromXML() or org.apache.sis.gml.GMLFactory that processes GML Coordinate Reference System definitions from XML
    Affected if The application parses GML CRS definitions from untrusted XML input
  5. Check for GPX parsing usage
    Search for usage of org.apache.sis.internal.gpx.GPXParser or any GPX (GPS Exchange Format) file parsing code that reads XML-based GPX files
    Affected if The application parses GPX files from untrusted sources
  6. Verify XML parser security configuration
    Check if the Java process is launched with system property javax.xml.accessExternalDTD or javax.xml.accessExternalSchema set to allow external access. Run: ps aux | grep java and inspect JAVA_OPTS or -D arguments. Also check any custom XMLTransformerFactory or DocumentBuilderFactory configurations in code that may disable entity resolver restrictions
    Affected if External DTD/schema access is not explicitly disabled (the property is not set to empty string)

A defender is affected if they run Apache SIS versions 0.4 through 1.5 AND use any of the four vulnerable parsing functions (GeoTIFF metadata, ISO 19115 XML, GML CRS, or GPX) with untrusted XML input while external entity access remains enabled in the XML parser configuration.

Generated from the published advisory. Verify against your own configuration.

Check your environment

Paste your version and any relevant configuration and it will be compared against the affected criteria above. Do not include secrets or credentials.

AI-assisted, checked against the advisory. Informational, not a guarantee.

Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.

dbcve · scoped
Upgrade available Upgrade to a release after 1.5
Interim mitigation

Upgrade Apache SIS to version 1.6, or temporarily mitigate by launching Java with `-Djavax.xml.accessExternalDTD=""` to disable external DTD access.

Recommended fix High confidence

1.6

  1. 1. Plan and schedule the upgrade to Apache SIS version 1.6 during a maintenance window
  2. 2. Before upgrading, review the Apache SIS 1.6 release notes for any migration requirements or deprecated features
  3. 3. Back up all existing Apache SIS configurations, data files, and custom configurations
  4. 4. Stop the Apache SIS service
  5. 5. Upgrade Apache SIS to version 1.6 by replacing the existing installation with the version 1.6 binaries or packages
  6. 6. Restore any custom configurations from the backup if needed
  7. 7. Start the Apache SIS service and verify it runs correctly
  8. 8. Test the affected functionality (GeoTIFF reading, ISO 19115 parsing, GML CRS parsing, and GPX parsing) to confirm the vulnerability is resolved

Generated from the published advisory — verify against the referenced sources before acting.

Fix this in Spatial Information System Scoped from the published advisory
  • Consultation2.0 h
  • Implementation4.0 h
  • Testing3.0 h
  • Review / QA1.0 h
10.0 hours of engineering $1,750
Get the upgrade done

An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $2,800.

Scan for this in your stack

Free · runs locally
dbcve dependency scanner

Check whether your project pulls in CVE-2025-68280 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.

Get it on GitHub Scan in the browser

References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.

Primary sources

Practitioner notes

Contributed

Peer-ranked notes from engineers who’ve handled CVE-2025-68280 in production — separate from our analysis above.

No notes yet

Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.

What this is

A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.

What belongs here
  • Verified mitigations, workarounds, and config changes
  • Version or environment caveats, and links to real fixes
  • No weaponised exploit code, or anything meant to cause harm
  • No spam, self-promotion, credentials, or personal data