CVE-2019-9944

HIGH

In Open Microscopy Environment OMERO.server 5.0.0 through 5.6.0, the reading of files from imported image filesets may circumvent OMERO permissions restrictions. This occurs because the Bio-Formats...

Affects 1 product across 1 vendor.

CVSS 3.17.5
EPSS1.1%
Percentile64th
PatchUnknown
CVSS Vector — Plain English Remotely exploitable over the network, low complexity, no authentication required, no user interaction needed, impact contained to the vulnerable component, full confidentiality impact, no integrity impact, no availability impact.
◆ AI Analysis — automated analysis, not human-reviewed

CVE-2019-9944 affects Open Microscopy Environment OMERO.server versions 5.0.0 through 5.6.0, allowing unauthorized access to files due to improper handling of embedded pathnames in image files.

BSID: BS-2020-GLOBAL-142468-H • Model: /workspace/models/qwen2.5-coder-32b-instruct-bf16 • Confidence: MEDIUM

Is this CVE in your environment?

BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.

Check My Environment →
Frequently Asked Questions
What is CVE-2019-9944?
CVE-2019-9944 affects Open Microscopy Environment OMERO.server versions 5.0.0 through 5.6.0, allowing unauthorized access to files due to improper handling of embedded pathnames in image files.
What is the CVSS score for CVE-2019-9944?
CVE-2019-9944 has CVSS 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS: 1.1%.
Is CVE-2019-9944 actively exploited?
No confirmed active exploitation of CVE-2019-9944 as of 2026-09-25.
How do I remediate CVE-2019-9944?
Priority: HIGH. Advisory: https://www.openmicroscopy.org/security/advisories/2019-SV1/ PSIRT: [email protected]
What systems are affected by CVE-2019-9944?
CVE-2019-9944 affects Openmicroscopy Omero.Server.
Vulnerability Details
CVE IDCVE-2019-9944
BSIDBS-2020-GLOBAL-142468-H BreachSpider Global ID
CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Published2020-06-17
Last Modified2026-06-17
ICS Relevance0%
SourceNVD
Official Description

In Open Microscopy Environment OMERO.server 5.0.0 through 5.6.0, the reading of files from imported image filesets may circumvent OMERO permissions restrictions. This occurs because the Bio-Formats feature allows an image file to have embedded pathnames.

Source: NIST NVD / MITRE CVE Database

Attack Vector Analysis — CITED Relevance

An attacker can exploit this vulnerability by importing an image file with an embedded pathname that points to a file outside the intended directory. This can lead to unauthorized file access and potential data leakage.

Exploitation Likelihood: MEDIUM

Affected Products
VendorProductAffected Versions
Openmicroscopy Omero.Server ≥ 5.0.0, ≤ 5.6.0
Remediation
View Vendor Advisory →

Remediation Priority: HIGH

Vendor PSIRT: [email protected]
Threat Intelligence
● Threat Intelligence Validated: October 2026 | Threat Age: 2311 Days
CISA known-exploitedNot in KEV catalog
Public ExploitNot confirmed
PoC CodeNot confirmed
AI Enrichment Record — provenance & audit hash
Model/workspace/models/qwen2.5-coder-32b-instruct-bf16
ConfidenceMEDIUM
Enriched At2026-05-24
SHA-512 Audit Hash8d5bae7beda212dc3614217828b87b10b7cb5fddcb77b92afc3b1f7f1841eca1b470e190c084ce83d5c986e5781006cd9e2b0f75f99a3901dc3288b5f49e0de9
Related CVEs affecting Openmicroscopy
CVE-2019-16244 9.8 OMERO.server before 5.6.1 allows attackers to bypass the security filters and... CVE-2014-7198 8.8 OMERO before 5.0.6 has multiple CSRF vulnerabilities because the framework fo... CVE-2017-1000438 8.3 In OMERO 5.3.3 or earlier a user could create an OriginalFile and adjust its ... CVE-2026-22187 7.8 Bio-Formats versions up to and including 8.3.0 perform unsafe Java deserializ... CVE-2019-9943 7.5 In ome.services.graphs.GraphTraversal.findObjectDetails in Open Microscopy En...
View all Openmicroscopy CVEs →

ICS/OT Vulnerability Intelligence for Your Environment

BreachSpider tracks 384,000+ CVEs and matches them to your ICS/OT assets by exact version, with AI analysis, NERC CIP mapping, and vendor PSIRT contacts.

Create a free account →