XML External Entity (XXE) vulnerability in MARC::File::XML module before 1.0.2 for Perl as used in Evergreen Koha perl4lib and possibly other products allows context-dependent attackers to read arbitrary files via a crafted XML file.