CVE-2025-66370

Kivitendo before 3.9.2 allows XXE injection. By uploading an electronic invoice in the ZUGFeRD format, it is possible to read and exfiltrate files from the server's filesystem.

CVSS v3 5.0 MEDIUM

5.0^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 3.1 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://blog.kivitendo.de/?p=1415
https://github.com/kivitendo/kivitendo-erp/blob/fd3f993fc731cbcaa5eb87d55df7c82df4df9c09/doc/changelog
https://github.com/kivitendo/kivitendo-erp/commit/1286dee72f9919166178d0cdb5f52f13b0f7d4de
https://github.com/kivitendo/kivitendo-erp/commit/f6ba56bd8d22a428534057589baace6b7bfdf2e9
https://invoice.secvuln.info

Configurations

No configuration.

History

19 Oct 2026, 13:10

Type	Values Removed	Values Added
Summary		(es) Kivitendo anterior a la versión 3.9.2 permite la inyección XXE. Al subir una factura electrónica en formato ZUGFeRD, es posible leer y exfiltrar archivos del sistema de archivos del servidor.

Information

Published : 2025-11-28 04:16

Updated : 2026-10-19 13:10

NVD link : CVE-2025-66370

Mitre link : CVE-2025-66370

CVE.ORG link : CVE-2025-66370

JSON object : View

Products Affected

No product.

CWE

CWE-611

Improper Restriction of XML External Entity Reference

{"id": "CVE-2025-66370", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-66370", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-11-28T15:58:09.742349Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "cve@mitre.org", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.0, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 3.1}]}, "affected": [{"source": "cve@mitre.org", "affectedData": [{"vendor": "kivitendo", "product": "kivitendo", "versions": [{"status": "affected", "version": "0", "lessThan": "3.9.2", "versionType": "custom"}], "defaultStatus": "unaffected"}]}], "published": "2025-11-28T04:16:01.110", "references": [{"url": "https://blog.kivitendo.de/?p=1415", "source": "cve@mitre.org"}, {"url": "https://github.com/kivitendo/kivitendo-erp/blob/fd3f993fc731cbcaa5eb87d55df7c82df4df9c09/doc/changelog", "source": "cve@mitre.org"}, {"url": "https://github.com/kivitendo/kivitendo-erp/commit/1286dee72f9919166178d0cdb5f52f13b0f7d4de", "source": "cve@mitre.org"}, {"url": "https://github.com/kivitendo/kivitendo-erp/commit/f6ba56bd8d22a428534057589baace6b7bfdf2e9", "source": "cve@mitre.org"}, {"url": "https://invoice.secvuln.info", "source": "cve@mitre.org"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "cve@mitre.org", "description": [{"lang": "en", "value": "CWE-611"}]}], "descriptions": [{"lang": "en", "value": "Kivitendo before 3.9.2 allows XXE injection. By uploading an electronic invoice in the ZUGFeRD format, it is possible to read and exfiltrate files from the server's filesystem."}, {"lang": "es", "value": "Kivitendo anterior a la versi\u00f3n 3.9.2 permite la inyecci\u00f3n XXE. Al subir una factura electr\u00f3nica en formato ZUGFeRD, es posible leer y exfiltrar archivos del sistema de archivos del servidor."}], "lastModified": "2026-10-19T13:10:00.110", "sourceIdentifier": "cve@mitre.org"}