PT-2025-48314 · Mustang · Mustang

Published 2025-11-28 · Updated 2025-12-26 · CVE-2025-66372

Positive Technologies (AI Summary)

CVSS v3.1

2.8

Low

Base vector

AV:L/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Mustang versions prior to 2.16.3

Description Mustang before version 2.16.3 is susceptible to XML External Entity (XXE) attacks, which can lead to the exfiltration of files. XXE attacks occur when an application parses XML input that contains a reference to an external entity. This can allow an attacker to access files on the system, internal shares, or other resources that the application has access to.

Recommendations Update Mustang to version 2.16.3 or later.

Fix

XXE

Weakness Enumeration

CWE-611

Related Identifiers

CVE-2025-66372

GHSA-X832-FPVJ-R5PH

Affected Products

Mustang

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2025-66372 · Security Note
• https://osv.dev/vulnerability/CVE-2025-66372 · Vendor Advisory
• https://github.com/ZUGFeRD/mustangproject/pull/725 · Note
• https://github.com/ZUGFeRD/mustangproject/releases/tag/core-2.16.3 · Note
• https://github.com/ZUGFeRD/mustangproject/issues/685 · Note
• https://twitter.com/oss_security/status/2004409450636222899 · Twitter Post
• https://twitter.com/CVEnew/status/1994250849145471127 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1994285322323079462 · Twitter Post
• https://t.me/CVEtracker/38426 · Telegram Post