Kitodo.Production 3.9.1 XML External Entity Injection

Kitodo.Production versions before 3.9.2 contain an XML external entity injection vulnerability in XMLUtils EAD imports. The proof of concept demonstrates local file disclosure through external entity resolution. https://packetstorm.news/download/237414...

Exploit for CVE-2026-54668

CVE-2026-54668 — PoC: XXE in Kitodo.Production XMLUtils Р...

CVE-2026-54668

Kitodo.Production is a workflow management tool for mass digitization and is part of the Kitodo Digital Library Suite. Prior to version 3.9.2, org.kitodo.production.helper.XMLUtils exposes several XML parsing helpers that construct a JAXP parser with the default, non-secure configuration. The...

CVE-2026-54668 Kitodo.Production: XXE in XMLUtils EAD/XML upload parsers (parseXMLString / getNumberOfEADElements / checkIfXmlIsWellFormed lack secure JAXP config)

Kitodo.Production is a workflow management tool for mass digitization and is part of the Kitodo Digital Library Suite. Prior to version 3.9.2, org.kitodo.production.helper.XMLUtils exposes several XML parsing helpers that construct a JAXP parser with the default, non-secure configuration. The...

CVE-2026-54668 Kitodo.Production: XXE in XMLUtils EAD/XML upload parsers (parseXMLString / getNumberOfEADElements / checkIfXmlIsWellFormed lack secure JAXP config)

Kitodo.Production is a workflow management tool for mass digitization and is part of the Kitodo Digital Library Suite. Prior to version 3.9.2, org.kitodo.production.helper.XMLUtils exposes several XML parsing helpers that construct a JAXP parser with the default, non-secure configuration. The...

CVE-2026-54668 Kitodo.Production: XXE in XMLUtils EAD/XML upload parsers (parseXMLString / getNumberOfEADElements / checkIfXmlIsWellFormed lack secure JAXP config)

Kitodo.Production is a workflow management tool for mass digitization and is part of the Kitodo Digital Library Suite. Prior to version 3.9.2, org.kitodo.production.helper.XMLUtils exposes several XML parsing helpers that construct a JAXP parser with the default, non-secure configuration. The...

CVE-2026-54668

Kitodo.Production , a workflow management tool within the Kitodo Digital Library Suite, is vulnerable to XML External Entity (XXE) injection in versions prior to 3.9.2 . The root cause is located in org.kitodo.production.helper.XMLUtils, where the methods parseXMLString(String), getNumberOfEADEle...

EUVD-2026-109091

Kitodo.Production is a workflow management tool for mass digitization and is part of the Kitodo Digital Library Suite. Prior to version 3.9.2, org.kitodo.production.helper.XMLUtils exposes several XML parsing helpers that construct a JAXP parser with the default, non-secure configuration. The...

CVE-2026-54668

Kitodo.Production is a workflow management tool for mass digitization and is part of the Kitodo Digital Library Suite. Prior to version 3.9.2, org.kitodo.production.helper.XMLUtils exposes several XML parsing helpers that construct a JAXP parser with the default, non-secure configuration. The...

Kitodo.Production input validation error vulnerability

Versions prior to Kitodo.Production 3.9.2 contain an input validation error vulnerability. This vulnerability arises because XML parsing helper methods use default insecure configurations to build JAXP parsers, without disabling DOCTYPE declarations or external entity resolution. As a result, the...

PT-2026-122143

Kitodo.Production is a workflow management tool for mass digitization and is part of the Kitodo Digital Library Suite. Prior to version 3.9.2, org.kitodo.production.helper.XMLUtils exposes several XML parsing helpers that construct a JAXP parser with the default, non-secure configuration. The...