Jackrabbit versions 2.x suffer from a WebDAV XXE injection vulnerability. Included are details and patches.