CyberSecBulletin

Kitodo vulnerabilities

We track 2 vulnerabilities in Kitodo products across 2 products. 2 are rated high or critical, and none are known to be exploited. The most recent was published on October 23, 2026.

2vulnerabilities
0critical
2high
0exploited
8.1average CVSS score

Latest Kitodo vulnerabilities

  • 8.7 High severity

    kitodo-production: Improper Restriction of XML External Entity Reference

    CVE-2026-54668Kitodo

    Kitodo.Production is a workflow management tool for mass digitization and is part of the Kitodo Digital Library Suite. Prior to version 3.9.2, org.kitodo.production.helper.XMLUtils exposes several XML parsing helpers that construct a JAXP parser with the defau

  • 7.5 High severity

    Kitodo.presentation: Server-Side Request Forgery

    CVE-2022-24980KitodoEPSS 1.2%

    An issue was discovered in the Kitodo.Presentation (aka dif) extension before 2.3.2, 3.x before 3.2.3, and 3.3.x before 3.3.4 for TYPO3. A missing access check in an eID script allows an unauthenticated user to submit arbitrary URLs to this component. This res