Vulnerabilities

TI-2026-79929 CVE-2026-54668

XXE injection in Kitodo.Production EAD/XML upload parsing

HIGH 73

Kitodo.Production is a workflow management tool for mass digitization and is part of the Kitodo Digital Library Suite.

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.00304 Published 2026-10-23 Fixed in 3.9.2 CWE-611

TI-2022-08774 CVE-2022-24980 · GHSA-x832-r2rj-4g5p

LOW 35

An issue was discovered in the Kitodo.Presentation (aka dif) extension before 2.3.2, 3.x before 3.2.3, and 3.3.x before 3.3.4 for TYPO3.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01201 Published 2022-02-19 Fixed in 2.3.2, 3.2.3 +1 CWE-918

TI-2020-12665 CVE-2020-16095 · GHSA-fpqv-x9hm-35j9

LOW 29

The dlf (aka Kitodo.Presentation) extension before 3.1.2 for TYPO3 allows XSS.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00869 Published 2020-07-29 Fixed in 3.1.2 CWE-79