CVE-2026-54668 in Kitodo.Production
Summary
by MITRE • 10/23/2026
Kitodo.Production is a workflow management tool for mass digitization and is part of the Kitodo Digital Library Suite. Prior to version 3.9.2, org.kitodo.production.helper.XMLUtils exposes several XML parsing helpers that construct a JAXP parser with the default, non-secure configuration. The methods parseXMLString(String), getNumberOfEADElements(String, String) and checkIfXmlIsWellFormed(String) build a DocumentBuilderFactory / XMLInputFactory / SAXParserFactory via newInstance() and parse the attacker-supplied string without disabling DOCTYPE declarations or external entity resolution. These helpers sit directly on the EAD-import path: an authenticated user who uploads an EAD/XML file through the "Create process" file-upload dialog has the uploaded bytes parsed by these methods. A crafted document with an external entity therefore yields XML External Entity (XXE) injection: local file disclosure and outbound SSRF requests from the server. This issue has been patched in version 3.9.2.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/23/2026
Kitodo.Production serves as a critical workflow management tool designed for mass digitization within digital library ecosystems, forming an integral component of the Kitodo Digital Library Suite. The software facilitates the ingestion and processing of complex archival metadata formats, particularly Encoded Archival Description (EAD) files which are typically structured in XML. In versions prior to 3.9.2, a significant security deficiency existed within the core utility class org.kitodo.production.helper.XMLUtils. This class provides several helper methods intended for parsing and validating XML content, specifically parseXMLString, getNumberOfEADElements, and checkIfXmlIsWellFormed. These methods are responsible for constructing JAXP parsers using standard Java APIs such as DocumentBuilderFactory, XMLInputFactory, and SAXParserFactory via their default newInstance() constructors without applying any security hardening configurations.
The technical flaw stems from the failure to disable external entity resolution and DOCTYPE declarations when initializing these parser instances. By relying on the default configuration of the underlying XML processing libraries, the application remains vulnerable to XML External Entity injection attacks. In a secure implementation, parsers should explicitly set features that prevent the loading of external entities or restrict access to local file systems. The absence of these safeguards means that any XML content processed by these methods is interpreted with full entity expansion capabilities, allowing an attacker to define custom entities that reference resources outside the intended document scope.
This vulnerability has direct operational impact on users interacting with the EAD-import functionality. Specifically, when an authenticated user uploads an EAD or XML file through the Create process file-upload dialog, the uploaded bytes are passed directly to these vulnerable helper methods for parsing and validation. An attacker who possesses valid authentication credentials can craft a malicious XML document containing external entity definitions that point to sensitive local files on the server's filesystem or to internal network endpoints. Upon processing this crafted input, the parser will resolve these entities, leading to two primary attack vectors: local file disclosure and Server-Side Request Forgery.
In the context of local file disclosure, an attacker can configure an external entity to read arbitrary files from the server where Kitodo.Production is hosted. This could result in the exposure of configuration files containing database credentials, private keys, or other sensitive application data. The retrieved content would be returned within the XML parsing response or error messages generated by the parser, allowing the attacker to exfiltrate this information. Alternatively, through Server-Side Request Forgery, an attacker can force the server to make HTTP requests to internal services that are not publicly accessible. This can lead to further reconnaissance of the internal network architecture, exploitation of other vulnerable services running on localhost or private IP ranges, and potential pivoting into more critical parts of the infrastructure.
From a classification perspective, this vulnerability aligns with CWE-611, which describes Improper Restriction of XML External Entity Reference. It also maps to MITRE ATT&CK technique T1208, Weak Encryption for Transport, although in this context it is more accurately described under data exfiltration techniques enabled by XXE, such as T1537 or general exploitation patterns associated with injection flaws like CWE-94. The attack requires authentication, which limits the threat landscape to insider threats or compromised user accounts rather than unauthenticated remote attackers.
To mitigate this vulnerability, organizations running Kitodo.Production versions prior to 3.9.2 must upgrade immediately to version 3.9.2 where the issue has been patched. For environments that cannot be upgraded instantly, temporary mitigations should focus on network-level controls such as implementing strict egress filtering to prevent the server from making unauthorized outbound connections and restricting access to sensitive local files via operating system permissions. Additionally, deploying a Web Application Firewall with rules capable of detecting XML External Entity patterns in uploaded content can provide an additional layer of defense against exploitation attempts while permanent remediation is pursued.