PT-2025-48313 · Peppol-Py · Peppol-Py

Published 2025-11-28 · Updated 2025-11-28 · CVE-2025-66371

Positive Technologies · (AI Summary)

CVSS v3.1

5.0

5.0

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Peppol-py versions prior to 1.1.1

Description The software is susceptible to XML External Entity (XXE) attacks due to the Saxon configuration. During the validation of XML-based invoices, the XML parser is capable of reading files from the filesystem and exposing their content to a remote host.

Recommendations Update to version 1.1.1 or later.

Fix

XXE

Weakness Enumeration

CWE-611

Related Identifiers

CVE-2025-66371

Affected Products

Peppol-Py

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2025-66371 · Security Note
• https://github.com/iterasdev/peppol-py/pull/16 · Note
• https://github.com/iterasdev/peppol-py/releases/tag/1.1.1 · Note
• https://t.me/CVEtracker/38425 · Telegram Post
• https://twitter.com/CVEnew/status/1994250848289915087 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1994290442016366850 · Twitter Post