GHSA-fcqj-76g3-q7qm

Source

https://github.com/advisories/GHSA-fcqj-76g3-q7qm

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/01/GHSA-fcqj-76g3-q7qm/GHSA-fcqj-76g3-q7qm.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-fcqj-76g3-q7qm

Aliases

CVE-2026-22186
GHSA-x9vc-qh97-8gjp

Published

2026-01-07T21:31:56Z

Modified

2026-04-02T13:26:22Z

Severity

7.1 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H CVSS Calculator
4.6 (Medium) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N CVSS Calculator

Summary

Bio-Formats has an XML External Entity (XXE) vulnerability

Details

Bio-Formats versions up to and including 8.3.0 contain an XML External Entity (XXE) vulnerability in the Leica Microsystems metadata parsing component (e.g., XLEF). The parser uses an insecurely configured DocumentBuilderFactory when processing Leica XML-based metadata files, allowing external entity expansion and external DTD loading. A crafted metadata file can trigger outbound network requests (SSRF), access local system resources where readable, or cause a denial of service during XML parsing.

Database specific

{
    "cwe_ids":  [
        "CWE-611"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-01-08T17:33:26Z",
    "nvd_published_at":  "2026-01-07T21:16:02Z",
    "severity":  "MODERATE"
}

References

Affected packages

Maven / ome:pom-bio-formats

Package

Name: ome:pom-bio-formats; View open source insights on deps.dev
Purl: pkg:maven/ome/pom-bio-formats

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Last Affected

8.3.0

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/01/GHSA-fcqj-76g3-q7qm/GHSA-fcqj-76g3-q7qm.json"