PT-2025-48312 · Kivitendo · Kivitendo

Published 2025-11-28 · Updated 2025-12-26 · CVE-2025-66370

Positive Technologies (AI Summary)

CVSS v3.1

5.0

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Kivitendo versions prior to 3.9.2

Description Kivitendo is susceptible to an XML External Entity (XXE) injection. An attacker can exploit this by uploading an electronic invoice in the ZUGFeRD format, potentially allowing them to read and exfiltrate files from the server's filesystem. XXE injection occurs when an application parses XML input that contains a reference to an external entity. This can allow an attacker to access sensitive information or execute arbitrary code on the server.

Recommendations Update Kivitendo to version 3.9.2 or later.

Fix

XXE

Weakness Enumeration

CWE-611

Related Identifiers

CVE-2025-66370

Affected Products

Kivitendo

References · 11

• https://osv.dev/vulnerability/CVE-2025-66370 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-66370 · Security Note
• https://github.com/kivitendo/kivitendo-erp/blob/fd3f993fc731cbcaa5eb87d55df7c82df4df9c09/doc/changelog · Note
• https://github.com/kivitendo/kivitendo-erp/commit/f6ba56bd8d22a428534057589baace6b7bfdf2e9 · Note
• https://github.com/kivitendo/kivitendo-erp/commit/1286dee72f9919166178d0cdb5f52f13b0f7d4de · Note
• https://twitter.com/VulmonFeeds/status/1994287882274549870 · Twitter Post
• https://twitter.com/CVEnew/status/1994250847354528083 · Twitter Post
• https://invoice.secvuln.info · Note
• https://twitter.com/oss_security/status/2004409450636222899 · Twitter Post
• https://blog.kivitendo.de/?p=1415 · Note
• https://t.me/CVEtracker/38424 · Telegram Post