In Open Microscopy Environment OMERO.server 5.0.0 through 5.6.0, the reading of files from imported image filesets may circumvent OMERO permissions restrictions. This occurs because the Bio-Formats feature allows an image file to have embedded pathnames.
Source: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9944
Reference (s):
- https://www.openmicroscopy.org/security/advisories/2019-SV1/