PT-2025-48313 · Peppol-Py · Peppol-Py

Published 2025-11-28 · Updated 2025-12-26 · CVE-2025-66371

Positive Technologies (AI Summary)

CVSS v3.1

5.0

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Peppol-py versions prior to 1.1.1

Description Peppol-py before version 1.1.1 contains a flaw due to the Saxon configuration that allows for XML External Entity (XXE) attacks. When processing XML-based invoices, the XML parser is susceptible to reading files from the filesystem and potentially exposing their content to a remote host.

Recommendations Update Peppol-py to version 1.1.1 or later.

Fix

XXE

Weakness Enumeration

CWE-611

Related Identifiers

CVE-2025-66371

GHSA-24HM-WM2H-H8W7

Affected Products

Peppol-Py

References · 12

• https://osv.dev/vulnerability/GHSA-24hm-wm2h-h8w7 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-66371 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-66371 · Security Note
• https://github.com/iterasdev/peppol-py/pull/16 · Note
• https://github.com/iterasdev/peppol-py · Note
• https://github.com/iterasdev/peppol-py/commit/349a4bff8adb6205ea411bac8d7a06da0477abd7 · Note
• https://github.com/iterasdev/peppol-py/releases/tag/1.1.1 · Note
• https://twitter.com/oss_security/status/2004409450636222899 · Twitter Post
• https://twitter.com/CVEnew/status/1994250848289915087 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1994290442016366850 · Twitter Post
• https://t.me/CVEtracker/38425 · Telegram Post
• https://invoice.secvuln.info · Note