CVE-2025-68280: 
Java vulnerability analysis and mitigation

CVE-2025-68280 is an XML External Entity (XXE) injection vulnerability in Apache Spatial Information System (SIS) that allows attackers to read arbitrary local files from the server. It affects Apache SIS versions 0.4 through 1.5 inclusive and was disclosed on January 5, 2026, by Martin Desruisseaux via the oss-security mailing list, with the finder credited as "LEE." The vulnerability carries a CVSS v3.1 base score of 6.5 (Medium), assessed by CISA-ADP (Apache Mailing List, oss-security).

The vulnerability is classified as CWE-611 (Improper Restriction of XML External Entity Reference). Apache SIS fails to disable or restrict external entity resolution when parsing XML content, allowing a crafted XML file containing a malicious DTD or external entity reference to cause the parser to fetch and return the contents of local files on the server. The flaw affects four distinct SIS parsing surfaces: GeoTIFF files with the DGIWG GEO_METADATA tag, ISO 19115 metadata in XML format, Coordinate Reference Systems in GML format, and GPS Exchange Format (GPX) files. Exploitation requires user interaction — specifically, a server-side process must parse an attacker-supplied or attacker-influenced XML file. The fix was implemented in commit 5bfa162bd56edb7d41d56a0c926592964d31d83b on the Apache SIS GitHub repository (oss-security, oss-security reply).

Successful exploitation allows an unauthenticated remote attacker to read arbitrary local files from the server running Apache SIS, resulting in a high confidentiality impact. Sensitive files such as configuration files, credentials, private keys, or application data could be exfiltrated depending on the permissions of the Java process. There is no integrity or availability impact, but file disclosure could enable further attacks such as credential theft or lateral movement (oss-security, Red Hat CVE).

1. Identify target: Locate a service or application that uses Apache SIS versions 0.4–1.5 and accepts user-supplied or externally sourced geospatial files (GeoTIFF with GEO_METADATA, ISO 19115 XML, GML, or GPX).
2. Craft malicious XML payload: Create an XML file with an embedded external entity declaration referencing a sensitive local file, for example:

   <?xml version="1.0" encoding="UTF-8"?>
   <!DOCTYPE foo [
     <!ENTITY xxe SYSTEM "file:///etc/passwd">
   ]>
   <root>&xxe;</root>

3. Deliver the payload: Submit the crafted file to the target application through any upload mechanism, API endpoint, or data ingestion pipeline that triggers Apache SIS parsing (e.g., upload a malicious GPX or GML file).
4. Trigger parsing: Cause the application to parse the submitted file using Apache SIS, which will resolve the external entity reference and include the contents of the targeted local file in the parsed output.
5. Exfiltrate data: Retrieve the server's response or application output containing the contents of the local file (e.g., /etc/passwd, application configuration files, or private keys) (oss-security, oss-security reply).

• Network: Unusual outbound DNS or HTTP requests from the Java process hosting Apache SIS to external hosts (in cases where the XXE payload references a remote URI rather than a local file).
• Logs: Application or server logs showing parsing of unexpected or externally sourced GeoTIFF, GML, GPX, or ISO 19115 XML files; Java XML parser errors or stack traces related to external entity resolution.
• File System: Unexpected access to sensitive files (e.g., /etc/passwd, application config files) by the Java process, detectable via file access auditing (e.g., Linux auditd with -w /etc/passwd -p r).
• Process: Java process making file read system calls to sensitive paths not normally accessed during geospatial data processing.

Users should upgrade Apache SIS to version 1.6, which resolves the vulnerability. As an immediate workaround for those unable to upgrade, launch the Java process with the system property javax.xml.accessExternalDTD set to an empty string to block all external DTD access: java -Djavax.xml.accessExternalDTD="" .... This property can also be set to a comma-separated list of permitted protocols if some external DTD access is required. Organizations should also restrict file upload endpoints to trusted users and validate file types before passing them to Apache SIS parsers (oss-security, Apache Mailing List).

Security researcher Sebastian Pipping commented on the oss-security list that the fix commit was identified and noted that Oracle should address longstanding insecure defaults in Java's XML parsers, which have contributed to XXE vulnerabilities across many projects for years (oss-security reply). Security news outlet SecurityOnline.info covered the vulnerability with the headline "Apache SIS Patch Blocks XML Attack That Leaks Server Files" (SecurityOnline). The vulnerability was also noted in the GitLab advisory database and by the Spanish National Cryptologic Centre (CCN-CERT).