CVE-2025-66370

—

CVSS 3.1

5.0 medium

EPSS

<1%p26

Published

Nov 28, 2025 (Nov 28, 2025)

Modified

Jun 17, 2026

Description

Kivitendo before 3.9.2 allows XXE injection. By uploading an electronic invoice in the ZUGFeRD format, it is possible to read and exfiltrate files from the server's filesystem.

Weakness: CWE-611
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

NVD CVE.org GitHub PoCs EPSS (0.3%)

In the news0 stories

No ingested article mentions this CVE yet.