kitodo CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

HIGH kitodo CVE published 2026-10-23

CVE-2026-54668

CVE-2026-54668 Kitodo.Production XMLUtils EAD/XML upload parsers have an XXE injection vulnerability, allowing authenticated users to inject malicious XML entities, potentially leading to local file disclosure and outbound SSRF requests. This issue was patched in version 3.9.2. Affected users should verify exposure and upgrade to prevent exploitation. The vulnerability has a high severity score and requir [truncated]