CVE-2026-91111 - Uploaded XML XSS

More info at https://www.silverstripe.org/download/security-releases/cve-2026-91111...

EUVD-2026-39593

A flaw was found in Apicurio Registry. The DocumentBuilderAccessor correctly blocks external DTD and schema access but does not disable DOCTYPE declarations or enable FEATURESECUREPROCESSING. An attacker with artifact-write permission can upload XML documents with internal entity-expansion payloa...