CVE-2026-54668 Kitodo.Production: XXE in XMLUtils EAD/XML upload parsers (parseXMLString / getNumberOfEADElements / checkIfXmlIsWellFormed lack secure JAXP config)

Kitodo.Production is a workflow management tool for mass digitization and is part of the Kitodo Digital Library Suite. Prior to version 3.9.2, org.kitodo.production.helper.XMLUtils exposes several XML parsing helpers that construct a JAXP parser with the default, non-secure configuration. The...

CVE-2026-54668

Kitodo.Production , a workflow management tool within the Kitodo Digital Library Suite, is vulnerable to XML External Entity (XXE) injection in versions prior to 3.9.2 . The root cause is located in org.kitodo.production.helper.XMLUtils, where the methods parseXMLString(String), getNumberOfEADEle...