Kitodo.Production CVE-2026-54668

Requires an authenticated account with permission to create a process / run catalog or EAD import - any role that can reach the 'Create process' file-upload dialog; no administrator privilege is needed, and the attacker fully controls the uploaded XML bytes. The trigger is the EAD-import path routing uploaded bytes to XMLUtils.parseXMLString, getNumberOfEADElements and checkIfXmlIsWellFormed, which build DocumentBuilderFactory/XMLInputFactory/SAXParserFactory via newInstance() with the default (insecure) JAXP configuration, leaving DOCTYPE declarations and external entity/DTD resolution enabled. No non-default configuration is required - the vulnerable methods ship insecure by default in versions <= 3.9.1. Limiting factors: authentication plus access to the import feature, and the bug being fixed in 3.9.2 (sibling parsers load()/newDocument() and the catalog-response handlers were already hardened, so only the upload path is affected).

This is a genuine but conditional priority rather than a mass-exploitation emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N, VC:H/VI:H/VA:H, score 8.7 High) and CWE-611 are consistent with the confirmed mechanism: an authenticated user (PR:L) uploads attacker-controlled XML that an unhardened JAXP parser expands, yielding file disclosure and SSRF. The key limiting signal is PR:L - exploitation requires an account that can reach the 'Create process' import dialog, so this is not an anonymous internet-facing bug despite AV:N. No CISA KEV listing and no EPSS score are provided, so there is no evidence of active or widespread exploitation; the vuln.today Decision label is 'this_week' (not act_now/emergency), aligning with a patch-promptly posture rather than drop-everything. A public PoC exists in the GitHub advisory, but it demonstrates XXE against byte-for-byte copies of the vulnerable method bodies on OpenJDK 17, not against a live deployed Kitodo instance, so exploitability against the running product is strongly inferred but not independently verified end-to-end. Note the vendor CVSS claims VC:H/VI:H/VA:H (full triad); the documented impact is primarily confidentiality (local file read, SSRF) with secondary availability (billion-laughs DoS) and only indirect integrity via SSRF-triggered requests, so the integrity/availability 'High' ratings look aggressive relative to the described mechanism.

An authenticated Kitodo user with permission to create a process uploads a crafted EAD/XML file through the 'Create process' file-upload dialog; the server parses it with a default-configured JAXP parser that resolves an embedded external entity, reading a local file (e.g. a config file containing DB credentials) or issuing an outbound request to an internal/cloud-metadata endpoint. A public PoC in the advisory reproduces both file disclosure and OOB-SSRF against verbatim copies of the vulnerable methods on OpenJDK 17. Low attack complexity means no special timing or grooming is needed once the attacker holds an import-capable account.