CVE-2026-54668
Received Received - Intake

BaseFortify

Publication date: 2026-10-23

Last updated on: 2026-10-23

Assigner: GitHub, Inc.

Description
Kitodo.Production is a workflow management tool for mass digitization and is part of the Kitodo Digital Library Suite. Prior to version 3.9.2, org.kitodo.production.helper.XMLUtils exposes several XML parsing helpers that construct a JAXP parser with the default, non-secure configuration. The methods parseXMLString(String), getNumberOfEADElements(String, String) and checkIfXmlIsWellFormed(String) build a DocumentBuilderFactory / XMLInputFactory / SAXParserFactory via newInstance() and parse the attacker-supplied string without disabling DOCTYPE declarations or external entity resolution. These helpers sit directly on the EAD-import path: an authenticated user who uploads an EAD/XML file through the "Create process" file-upload dialog has the uploaded bytes parsed by these methods. A crafted document with an external entity therefore yields XML External Entity (XXE) injection: local file disclosure and outbound SSRF requests from the server. This issue has been patched in version 3.9.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-23
Last Modified
2026-10-23
Generated
2026-10-23
AI Q&A
2026-10-23
EPSS Evaluated
N/A
NVD
CVE-2026-54668
EUVD
EUVD-2026-109091

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
kitodo kitodo-production < 3.9.2

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-611 The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an XML External Entity (XXE) injection flaw in Kitodo.Production versions before 3.9.2. It allows authenticated users to upload malicious XML files that are parsed by insecure XML parsing methods. These methods do not disable dangerous features like external entity resolution, enabling attackers to read local files or make outbound server requests.

Detection Guidance

Detecting this vulnerability requires checking for XXE in XML parsing within Kitodo.Production versions before 3.9.2. Inspect logs for file access or outbound requests during EAD/XML uploads. Use tools like OWASP ZAP or Burp Suite to test XML uploads for XXE payloads. Check server logs for unexpected file reads or external connections after XML processing.

Impact Analysis

An attacker could exploit this to access sensitive files on the server, perform server-side request forgery (SSRF) attacks, or potentially escalate privileges. The impact depends on server configuration and user permissions. Since it requires authentication, the risk is limited to users with upload access.

Compliance Impact

This vulnerability could lead to unauthorized data access, violating GDPR's data protection requirements or HIPAA's safeguards for protected health information. Organizations using affected versions may face compliance violations, legal penalties, and reputational damage due to potential data breaches.

Mitigation Strategies

Upgrade Kitodo.Production to version 3.9.2 or later immediately. If upgrading is not possible, disable DOCTYPE declarations and external entity resolution in XML parsing libraries used by Kitodo.Production. Restrict user permissions to prevent unauthorized file uploads. Monitor network traffic for unusual outbound requests from the server.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-54668. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart