{"id":"CVE-2026-54668","title":"Kitodo.Production: XXE in XMLUtils EAD/XML upload parsers (parseXMLString / getNumberOfEADElements / checkIfXmlIsWellFormed lack secure JAXP config)","summary":"Kitodo.Production is a workflow management tool for mass digitization and is part of the Kitodo Digital Library Suite. Prior to version 3.9.2, org.kitodo.production.helper.XMLUtils exposes several XML parsing helpers that construct a JAX…","severity":"high","cvss":8.7,"cvssVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","cvssSource":"cna","cwe":["CWE-611"],"vendor":"kitodo","product":"kitodo-production","affected":["kitodo-production < 3.9.2"],"published":"2026-10-23","updated":"2026-10-23","sourceUpdated":"2026-10-23T14:54:35.530Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-54668","references":[{"url":"https://github.com/kitodo/kitodo-production/security/advisories/GHSA-mff2-fpqj-jg4q","label":"https://github.com/kitodo/kitodo-production/security/advisories/GHSA-mff2-fpqj-jg4q"},{"url":"https://github.com/kitodo/kitodo-production/releases/tag/kitodo-production-3.9.2","label":"https://github.com/kitodo/kitodo-production/releases/tag/kitodo-production-3.9.2"}],"tags":["cve.org"],"ingestedAt":"2026-10-23T15:29:36.881Z","slug":"CVE-2026-54668","body":"## Overview\n\nKitodo.Production is a workflow management tool for mass digitization and is part of the Kitodo Digital Library Suite. Prior to version 3.9.2, org.kitodo.production.helper.XMLUtils exposes several XML parsing helpers that construct a JAXP parser with the default, non-secure configuration. The methods parseXMLString(String), getNumberOfEADElements(String, String) and checkIfXmlIsWellFormed(String) build a DocumentBuilderFactory / XMLInputFactory / SAXParserFactory via newInstance() and parse the attacker-supplied string without disabling DOCTYPE declarations or external entity resolution. These helpers sit directly on the EAD-import path: an authenticated user who uploads an EAD/XML file through the \"Create process\" file-upload dialog has the uploaded bytes parsed by these methods. A crafted document with an external entity therefore yields XML External Entity (XXE) injection: local file disclosure and outbound SSRF requests from the server. This issue has been patched in version 3.9.2.\n\n## Affected\n\n- `kitodo-production < 3.9.2`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":48,"depthScoreParts":{"impact":47.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}