{"id":"CVE-2026-54668","revision":"ba8fa9710b824214b567f8bfab76bbcf","records":[{"revision":"ba8fa9710b824214b567f8bfab76bbcf","observedAt":"2026-10-23T16:01:20.601+00:00","statement":{"source":"cve-program","id":"CVE-2026-54668","aliases":[],"title":"Kitodo.Production: XXE in XMLUtils EAD/XML upload parsers (parseXMLString / getNumberOfEADElements / checkIfXmlIsWellFormed lack secure JAXP config)","description":"Kitodo.Production is a workflow management tool for mass digitization and is part of the Kitodo Digital Library Suite. Prior to version 3.9.2, org.kitodo.production.helper.XMLUtils exposes several XML parsing helpers that construct a JAXP parser with the default, non-secure configuration. The methods parseXMLString(String), getNumberOfEADElements(String, String) and checkIfXmlIsWellFormed(String) build a DocumentBuilderFactory / XMLInputFactory / SAXParserFactory via newInstance() and parse the attacker-supplied string without disabling DOCTYPE declarations or external entity resolution. These helpers sit directly on the EAD-import path: an authenticated user who uploads an EAD/XML file through the \"Create process\" file-upload dialog has the uploaded bytes parsed by these methods. A crafted document with an external entity therefore yields XML External Entity (XXE) injection: local file disclosure and outbound SSRF requests from the server. This issue has been patched in version 3.9.2.","state":0,"publishedAt":"2026-10-23T14:54:35.53+00:00","modifiedAt":"2026-10-23T14:54:35.53+00:00","affected":[{"ecosystem":"Vendor product","name":"kitodo-production","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"kitodo\",\n                    \"product\": \"kitodo-production\",\n                    \"versions\": [\n                        {\n                            \"version\": \"< 3.9.2\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","score":8.7,"severity":"HIGH"}],"references":["https://github.com/kitodo/kitodo-production/security/advisories/GHSA-mff2-fpqj-jg4q","https://github.com/kitodo/kitodo-production/releases/tag/kitodo-production-3.9.2"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-54668","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-54668","identifiers":["CVE-2026-54668"]},"retained":false,"historicalAffected":[]}],"coverage":[]}