XML External Entity Injection in Kitodo.Production Workflow Management Tool
CVE-2026-54668

8.7HIGH

Key Information:

Vendor

Kitodo

Status
Kitodo-production
Vendor
CVE Published:
23 October 2026

What is CVE-2026-54668?

Kitodo.Production, a tool for workflow management in mass digitization, contains a vulnerability that allows XML External Entity (XXE) injection. Prior to version 3.9.2, the application’s XML parsing components did not adequately disable sensitive features such as DOCTYPE declarations and external entity resolution when parsing uploaded EAD/XML files. This flaw permits authenticated users to upload specially crafted XML documents that can lead to local file disclosure and potentially enable Server-Side Request Forgery (SSRF) attacks. The issue has been effectively patched in version 3.9.2 to enhance security.

Affected Version(s)

kitodo-production < 3.9.2

References

https://github.com/kitodo/kitodo-production/security/advi...
x_refsource_CONFIRM
https://github.com/kitodo/kitodo-production/releases/tag/...
x_refsource_MISC

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.