Vulnerability Description
Peppol-py before 1.1.1 allows XXE attacks because of the Saxon configuration. When validating XML-based invoices, the XML parser could read files from the filesystem and expose their content to a remote host.
CVSS Score
MEDIUM
Related Weaknesses (CWE)
References
- https://github.com/iterasdev/peppol-py/commit/349a4bff8adb6205ea411bac8d7a06da04
- https://github.com/iterasdev/peppol-py/pull/16
- https://github.com/iterasdev/peppol-py/releases/tag/1.1.1
- https://invoice.secvuln.info
FAQ
What is CVE-2025-66371?
CVE-2025-66371 is a vulnerability with a CVSS score of 5.0 (MEDIUM). Peppol-py before 1.1.1 allows XXE attacks because of the Saxon configuration. When validating XML-based invoices, the XML parser could read files from the filesystem and expose their content to a remo...
How severe is CVE-2025-66371?
CVE-2025-66371 has been rated MEDIUM with a CVSS base score of 5.0/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2025-66371?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.