CVE-2025-66370CWE-611xxe

CVE-2025-66370

Medium · published November 28, 2025

CVSS v3.1
5.0
EPSS
0%
Percentile
24.5
In the wild
Unconfirmed
What it is

Kivitendo before 3.9.2 allows XXE injection. By uploading an electronic invoice in the ZUGFeRD format, it is possible to read and exfiltrate files from the server's filesystem.

The record
Technical detail
CVSS v3.1
5.0 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00327 · 24.5th percentile
Weakness
CWE-611 · Improper Restriction of XML External Entity Reference
Published
2025-11-28T09:16Z
References (5)
https://blog.kivitendo.de/?p=1415 · [email protected]https://github.com/kivitendo/kivitendo-erp/blob/fd3f993fc731cbcaa5eb87d55df7c82df4df9c09/doc/changelog · [email protected]https://github.com/kivitendo/kivitendo-erp/commit/1286dee72f9919166178d0cdb5f52f13b0f7d4de · [email protected]https://github.com/kivitendo/kivitendo-erp/commit/f6ba56bd8d22a428534057589baace6b7bfdf2e9 · [email protected]https://invoice.secvuln.info · [email protected]
EPSS history
Timeline
  • 28 NOV 00:00Z
    Kivitendo before 3.9.2 allows XXE injection
    cvelistv5