CVE-2026-22186
📋 TL;DR
Bio-Formats up to version 8.3.0 contains an XML External Entity (XXE) vulnerability in the Leica Microsystems metadata parser. This allows attackers to read local files, make outbound network requests (SSRF), or cause denial of service via specially crafted XLEF metadata files. Anyone using Bio-Formats to process Leica microscopy files is affected.
💻 Affected Systems
- Bio-Formats
📦 What is this software?
Bio Formats by Openmicroscopy
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise through SSRF to internal services, sensitive file disclosure, or complete service unavailability via DoS.
Likely Case
Local file disclosure from the server, limited SSRF to internal network resources, or temporary service disruption.
If Mitigated
Limited impact with proper network segmentation and file processing restrictions, potentially only DoS.
🎯 Exploit Status
Exploitation requires only a malicious XLEF file to be processed by vulnerable Bio-Formats.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 8.3.1 or later
Vendor Advisory: https://docs.openmicroscopy.org/bio-formats/
Restart Required: No
Instructions:
1. Upgrade Bio-Formats to version 8.3.1 or newer. 2. Update any applications or pipelines using Bio-Formats. 3. Test with existing Leica metadata files.
🔧 Temporary Workarounds
Disable external entity processing
allConfigure DocumentBuilderFactory to disable XXE features before parsing XML
factory.setFeature("http://xml.org/sax/features/external-general-entities", false);
factory.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
factory.setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd", false);
Input validation
allReject or sanitize XLEF files before processing
🧯 If You Can't Patch
- Restrict network egress from Bio-Formats servers to prevent SSRF
- Implement strict file upload controls and sandbox processing of XLEF files
🔍 How to Verify
Check if Vulnerable:
Check Bio-Formats version with 'java -jar bioformats.jar --version' or examine dependencies in your applicationCheck Version:
java -jar bioformats.jar --versionVerify Fix Applied:
Confirm version is 8.3.1+ and test with known malicious XLEF file📡 Detection & Monitoring
Log Indicators:
- Unusual outbound network connections from Bio-Formats process
- XML parsing errors or timeouts
- Unexpected file access patterns
Network Indicators:
- HTTP requests to internal services from Bio-Formats server
- DNS requests for unusual domains during file processing
SIEM Query:
source="bioformats" AND (event="xml_parse_error" OR dest_ip IN [internal_ips])