Live › vulnerability › CVE-2026-54668
Go to dashboardKitodo.Production's EAD/XML import parses uploaded files with an XML parser that resolves external entities. An logged-in user who uploads a crafted file can read local files on the server and make server-side requests to internal hosts.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
No product ranges from the sources yet.
Check the Kitodo.Production version in use; affected if older than 3.9.2.
Upgrade Kitodo.Production to 3.9.2 or later.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Kitodo.Production is a workflow management tool for mass digitization and is part of the Kitodo Digital Library Suite. Prior to version 3.9.2, org.kitodo.production.helper.XMLUtils exposes several XML parsing helpers that construct a JAXP parser with the default, non-secure configuration. The methods parseXMLString(String), getNumberOfEADElements(String, String) and checkIfXmlIsWellFormed(String) build a DocumentBuilderFactory / XMLInputFactory / SAXParserFactory via newInstance() and parse the attacker-supplied string without disabling DOCTYPE declarations or external entity resolution. These helpers sit directly on the EAD-import path: an authenticated user who uploads an EAD/XML file through the "Create process" file-upload dialog has the uploaded bytes parsed by these methods. A crafted document with an external entity therefore yields XML External Entity (XXE) injection: local file disclosure and outbound SSRF requests from the server. This issue has been patched in version 3.9.2.
This page as .md · .json · in your agent: get_signal("CVE-2026-54668")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.