kitodo/presentation vulnerabilities

CVEs whose affected-version data names the kitodo/presentation package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

1 CVERSS

CVE-2026-112237Medium· 6.9

today

Server-Side Request Forgery in extension "Kitodo.Presentation" (dlf)

The extension provides a public proxy endpoint that fetches a URL on behalf of the visitor. For one HTTP request method, the endpoint does not apply the authorization check that protects the other methods, so the URL it fetches is fully …

▾ SunlitTYPO3 · kitodo/presentationvia CVEORG