IT SBIT Services
Schneeberger
DEEN
CVE tracker

Kitodo.Production: XML External Entity (XXE) injection in EAD/XML upload

CVE-2026-54668High 8.7Public exploit

← All vulnerabilities

Summary

Kitodo.Production, a web application for mass digitization, parses XML files uploaded through the "Create process" dialog with insecure default XML parser settings. An authenticated user who can use this upload can submit a crafted file with an external entity to read local files on the server or send outbound requests (SSRF). The CNA scores the issue 8.7 (High), while VulDB rates it 6.3 (Medium).

Affected

  • Kitodo.Production before 3.9.2 (CNA: affected < 3.9.2)
  • The GitHub advisory lists <= 3.9.1; VulDB names 3.9.0 and 3.9.1
  • Earlier 3.x releases and the 4.0.x line: Unknown.

Fixed in

  • Kitodo.Production 3.9.2 (changelog item #7072 hardens the XMLUtils EAD/XML upload parsers)
  • Kitodo.Production 3.9.4 or later is recommended, as it also fixes a separate access-control issue.

Workaround

  • No workaround needed on patched systems.
  • Until the update is applied (recommendation, not from a source): limit "Create process" upload rights to trusted staff, remove unused accounts and restrict outbound connections from the application server.

Exploitation

  • Known exploited (KEV / in the wild): No evidence found.
  • CISA SSVC lists exploitation as "poc"; not automatable.
  • A third-party public proof-of-concept repository exists but was not verified.
  • VulDB states that no exploit is available.

Our recommendation

  • Inventory all Kitodo.Production installations and their versions.
  • Update to 3.9.4 or the latest supported 3.9.x release (at least 3.9.2); confirm the 4.0.x status with the vendor.
  • Review user accounts and upload permissions for the "Create process" dialog and restrict them.
  • Check whether the Kitodo web interface is reachable from the internet.
  • Review server logs for unusual EAD/XML uploads or unexpected outbound connections from the application server.

Public exploits

Links to third-party sites, not checked by us – exploit code can contain malware. Only use it in isolated test environments.

Research sources

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 00:25.

Original description (NVD)

Kitodo.Production is a workflow management tool for mass digitization and is part of the Kitodo Digital Library Suite. Prior to version 3.9.2, org.kitodo.production.helper.XMLUtils exposes several XML parsing helpers that construct a JAXP parser with the default, non-secure configuration. The methods parseXMLString(String), getNumberOfEADElements(String, String) and checkIfXmlIsWellFormed(String) build a DocumentBuilderFactory / XMLInputFactory / SAXParserFactory via newInstance() and parse the attacker-supplied string without disabling DOCTYPE declarations or external entity resolution. These helpers sit directly on the EAD-import path: an authenticated user who uploads an EAD/XML file through the "Create process" file-upload dialog has the uploaded bytes parsed by these methods. A crafted document with an external entity therefore yields XML External Entity (XXE) injection: local file disclosure and outbound SSRF requests from the server. This issue has been patched in version 3.9.2.

NVD references (3)

Sources

The tracker combines official, freely usable data sources – updated continuously:

This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.

Affected? We can help.

We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.

Get in touchRSS feed