CVE-2026-110748 — Apache SIS: CWE-22: improper limitation of paths to GML, GeoTIFF, NADCON or NTv2 files

This issue affects Apache SIS from version 0.7 through 1.6 inclusive. When a data file contained links to other files, Apache SIS opened those files regardless of their paths. For example, it was possible to specify a path to a local file. The affected references involve GML, NADCON, NTv2, RGF93 and GeoTIFF-related files.