{"action":"Upgrade org.apache.sis.core:sis-metadata to 1.6 or later.","affected":[{"fixed":"1.6","introduced":"0.4"}],"component":"org.apache.sis.core:sis-metadata","cve_ids":["CVE-2025-68280"],"ecosystem":"Maven","epss":0.00699,"exploited":false,"fixed_versions":["1.6"],"ghsa_id":"GHSA-jqmr-2pg9-vfx7","id":"tcs_01M5N93GRFTF6D73P1K96QZ00K","modified_at":"2026-02-03T03:13:50.599778Z","published_at":"2026-01-05T15:32:15Z","references":["https://osv.dev/vulnerability/GHSA-jqmr-2pg9-vfx7","https://nvd.nist.gov/vuln/detail/CVE-2025-68280","https://github.com/apache/sis","https://lists.apache.org/thread/s4ggy3zbtrrn93glgo2vn52lgcxk4bp4","http://www.openwall.com/lists/oss-security/2026/01/05/11","http://www.openwall.com/lists/oss-security/2026/01/05/7"],"severity":{"label":"medium","score":6.5},"sources":[{"source":"osv","source_id":"GHSA-jqmr-2pg9-vfx7","url":"https://osv.dev/vulnerability/GHSA-jqmr-2pg9-vfx7"}],"summary":"Apache SIS has Improper Restriction of XML External Entity Reference vulnerability"}