GitHub Advisoryadvisory · Maven

GHSA-fcqj-76g3-q7qm Bio-Formats has an XML External Entity (XXE) vulnerability

MEDIUM Published 2026-01-07 Modified 2026-03-19 Official page ↗
Aliases
CVE-2026-22186
Ecosystem
Maven
Packages
ome:pom-bio-formats
Severity
Moderate
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H
Weaknesses
CWE-611
Reviewed
2026-01-08

Affected packages

• Maven ome:pom-bio-formats: <= 8.3.0 (no fix yet)

Description

Bio-Formats versions up to and including 8.3.0 contain an XML External Entity (XXE) vulnerability in the Leica Microsystems metadata parsing component (e.g., XLEF). The parser uses an insecurely configured DocumentBuilderFactory when processing Leica XML-based metadata files, allowing external entity expansion and external DTD loading. A crafted metadata file can trigger outbound network requests (SSRF), access local system resources where readable, or cause a denial of service during XML parsing.

Related

Alias · CVE (1)

  • CVE-2026-22186 Bio-Formats versions up to and including 8.3.0 contain an XML External Entity (XXE) vulnerability in the Leica Microsystems metadata… vulnerability

Weakness · CWE (1)

  • CWE-611 Improper Restriction of XML External Entity Reference weakness

References