Apache SIS processes GML, WKT, and Landsat files that may include references to other files via attributes or parameters. The implementation does not enforce any limitation on the file path of these references, allowing an attacker to supply a reference that points to an arbitrary local file. Because the SIS parser expects the referenced file to be in a specific format, it reads only the first part of the file before aborting at the first parsing error, which means that the vulnerability is unlikely to leak large amounts of data. Nevertheless, the flaw permits unauthorized local file disclosure, which could expose configuration files, logs, or other sensitive data that the SIS process has permission to read.

Apache SIS, developed by the Apache Software Foundation, versions 0.7 through 1.6 inclusive are affected. Users of these versions should upgrade to version 1.7 or later.

The vulnerability has no available exploit probability metric and is not listed in the CISA KEV catalog, indicating that there is currently no known active exploitation. The attack vector is inferred to involve delivering a crafted GML, WKT, or Landsat file to a system running Apache SIS. If the SIS instance processes user‑supplied data over a network, an attacker could supply a link to a local file and influence the parsing process. The potential impact is unauthorized local file disclosure. The impact could be further expanded if the data loader reads executable code that an attacker has placed in the referenced file, allowing execution within the SIS process context. The CVSS score is not provided; however, the flaw allows an attacker to read arbitrary files, typically considered a serious confidentiality risk.