Apache SIS versions 0.7 through 1.6 have a vulnerability where the software opens linked files from data files without properly restricting their paths. This can lead to opening local files outside the intended directory. The vulnerability affects specific geographic data formats including GML, WKT with datum shift grids, and Landsat GeoTIFF bands. The risk of sensitive information leakage is low because the software stops reading at the first parsing error if the file format is unexpected. Version 1.7 of Apache SIS fixes this issue by restricting file paths to the same directory or a predetermined directory for datum shift grids.