CVEvulnerability

CVE-2025-66370

5.0 MEDIUM Published 2025-11-28 Modified 2026-10-19 Official page ↗
Status
Deferred
Published
2025-11-28
Last modified
2026-10-19
Assigner
[email protected]
CVSS 3.1 ([email protected])
5.0 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
Weaknesses
CWE-611

Description

Kivitendo before 3.9.2 allows XXE injection. By uploading an electronic invoice in the ZUGFeRD format, it is possible to read and exfiltrate files from the server's filesystem.

Related

Weakness · CWE (1)

  • CWE-611 Improper Restriction of XML External Entity Reference weakness

References