CVE-2026-54668 Details
Description
Kitodo.Production is a workflow management tool for mass digitization and is part of the Kitodo Digital Library Suite. Prior to version 3.9.2, org.kitodo.production.helper.XMLUtils exposes several XML parsing helpers that construct a JAXP parser with the default, non-secure configuration. The methods parseXMLString(String), getNumberOfEADElements(String, String) and checkIfXmlIsWellFormed(String) build a DocumentBuilderFactory / XMLInputFactory / SAXParserFactory via newInstance() and parse the attacker-supplied string without disabling DOCTYPE declarations or external entity resolution. These helpers sit directly on the EAD-import path: an authenticated user who uploads an EAD/XML file through the "Create process" file-upload dialog has the uploaded bytes parsed by these methods. A crafted document with an external entity therefore yields XML External Entity (XXE) injection: local file disclosure and outbound SSRF requests from the server. This issue has been patched in version 3.9.2.
A vulnerability in Kitodo.Production's XML parsing utilities for EAD files allows for XML External Entity (XXE) injection. This issue is present in versions through 3.9.1 of the software. The vulnerability arises because the parsing methods 'parseXMLString', 'getNumberOfEADElements', and 'checkIfXmlIsWellFormed' use a JAXP parser with the default, insecure settings, failing to disable DOCTYPE declarations or external entity resolution. As a result, an authenticated user can exploit this flaw by uploading a crafted EAD/XML file, leading to unauthorized access to local files and the ability to make outbound SSRF requests from the server.
Users should update to Kitodo.Production version 3.9.2 or later, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 23, 2026CISA-ADP
Assessed Oct 29, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/kitodo/kitodo-production/security/advisories/GHSA-mff2-fpqj-jg4q | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/kitodo/kitodo-production/releases/tag/kitodo-production-3.9.2 | [email protected] | Release NotesVendor |
| https://github.com/kitodo/kitodo-production/security/advisories/GHSA-mff2-fpqj-jg4q | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-611 | Improper Restriction of XML External Entity Reference | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Kitodo.Production | <= 3.9.1 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 29, 2026 | CVE Modified | CISA-ADP |
| Oct 23, 2026 | New CVE Received | [email protected] |