6.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-68280

CVE-2025-68280: Apache SIS: XML External Entity (XXE) vulnerability

Improper Restriction of XML External Entity Reference vulnerability in Apache SIS.

It is possible to write XML files in such a way that, when parsed by Apache SIS, an XML file reveals to the attacker the content of a local file on the server running Apache SIS. This vulnerability impacts the following SIS services:

Reading of GeoTIFF files having the GEO_METADATA tag defined by the Defense Geospatial Information Working Group (DGIWG).
Parsing of ISO 19115 metadata in XML format.
Parsing of Coordinate Reference Systems defined in the GML format.
Parsing of files in GPS Exchange Format (GPX).

This issue affects Apache SIS from versions 0.4 through 1.5 inclusive. Users are recommended to upgrade to version 1.6, which will fix the issue. In the meantime, the security vulnerability can be avoided by launching Java with the javax.xml.accessExternalDTD system property sets to a comma-separated list of authorized protocols. For example:

java -Djavax.xml.accessExternalDTD="" ...

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-68280

CVE-2025-68280:

6.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
org.apache.sis.core:sis-metadata	maven	>= 0.4, < 1.6	1.6

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a classic XML External Entity (XXE) injection issue within Apache SIS. The root cause lies in the use of javax.xml.stream.XMLInputFactory with its default, insecure configuration, which permits the processing of external entities defined in an XML document. This allows an attacker to supply a crafted XML file (e.g., within a GeoTIFF, GPX, or GML file) that references external entities pointing to local files on the server.

The analysis of the patch commit 5bfa162bd56edb7d41d56a0c926592964d31d83b reveals two primary locations where insecure XMLInputFactory instances were created:

org.apache.sis.storage.geotiff.reader.XMLMetadata.toXML(): This function, used for parsing XML metadata from GeoTIFF files, directly instantiated its own XMLInputFactory without secure settings.
org.apache.sis.storage.xml.stream.StaxDataStore.inputFactory(): This method served as a factory for XMLInputFactory instances for various XML data stores (including GPX, GML, and ISO 19115 metadata). It created a default, insecure factory that was then used by subclasses for parsing.

The fix involves modifying these methods to ensure that any created XMLInputFactory is configured securely. Specifically, the patch sets the FEATURE_SECURE_PROCESSING property to true and restricts the ACCESS_EXTERNAL_DTD property to only allow http and https protocols, effectively blocking the file protocol and mitigating the XXE vulnerability.

Vulnerable functions

org.apache.sis.storage.geotiff.reader.XMLMetadata.toXML

endorsed/src/org.apache.sis.storage.geotiff/main/org/apache/sis/storage/geotiff/reader/XMLMetadata.java

The `toXML` function in `XMLMetadata.java` was vulnerable to XXE because it created a new `XMLInputFactory` using `XMLInputFactory.newFactory()` without any security configurations. This default factory allows the processing of external XML entities, including local files. An attacker could craft a malicious GeoTIFF file with a specially designed XML metadata section that, when parsed by this function, would lead to the disclosure of local file contents. The patch replaces the local, insecure factory instantiation with a call to a centralized, secure `InputFactory`.

org.apache.sis.storage.xml.stream.StaxDataStore.inputFactory

endorsed/src/org.apache.sis.storage.xml/main/org/apache/sis/storage/xml/stream/StaxDataStore.java

The `inputFactory` method in the `StaxDataStore` class was responsible for creating and providing an `XMLInputFactory` for parsing various XML-based data stores like GPX, GML, and ISO 19115 metadata. The original implementation created a new factory using `XMLInputFactory.newInstance()` without setting any security features. This resulted in a factory that was vulnerable to XXE attacks. The patch addresses this by explicitly setting `XMLConstants.FEATURE_SECURE_PROCESSING` to `true` and restricting the `XMLConstants.ACCESS_EXTERNAL_DTD` property to prevent access to local files.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.