GHSA-fcqj-76g3-q7qm

Bio-Formats has an XML External Entity (XXE) vulnerability

Source: GitHub Advisory Database (reviewed) Moderate CVE-2026-22186

Packages

Ecosystem	Package	Affected	Fixed in
Maven	ome:pom-bio-formats	<= 8.3.0	no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

Bio-Formats versions up to and including 8.3.0 contain an XML External Entity (XXE) vulnerability in the Leica Microsystems metadata parsing component (e.g., XLEF). The parser uses an insecurely configured DocumentBuilderFactory when processing Leica XML-based metadata files, allowing external entity expansion and external DTD loading. A crafted metadata file can trigger outbound network requests (SSRF), access local system resources where readable, or cause a denial of service during XML parsing.

References

External links from the advisory. They lead to third-party sites.

https://github.com/ome/bioformats/security/advisories/GHSA-x9vc-qh97-8gjp web
https://nvd.nist.gov/vuln/detail/CVE-2026-22186 advisory
https://docs.openmicroscopy.org/bio-formats web
https://github.com/ome/bioformats package
https://seclists.org/fulldisclosure/2026/Jan/6 web
https://www.vulncheck.com/advisories/bio-formats-xxe-in-leica-xlef-metadata-parser web