CVE-2026-54640

The fix for CVE-2026-40882 addressed only the Velbus asset import handler. The KNX asset import handler "KNXProtocol" processes user-uploaded ETS project ZIP files through Saxon XSLT and "XMLInputFactory.newInstance" with no XXE protection, allowing any authenticated user to read arbitrary files...