{"id":"CVE-2025-66370","aliases":["EUVD-2025-199851","GHSA-6p6f-w7vp-pv39"],"status":"published","title":"Kivitendo before 3.9.2 allows XXE injection. By uploading an electronic invoice in the ZUGFeRD...","description":"Kivitendo before 3.9.2 allows XXE injection. By uploading an electronic invoice in the ZUGFeRD format, it is possible to read and exfiltrate files from the server's filesystem.","severity":{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.0035,"percentile":0.28964,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-611"],"published":"2025-11-28T00:00:00Z","modified":"2026-10-28T02:30:58Z","products":[{"vendor":"kivitendo","product":"kivitendo"}],"references":[{"url":"https://github.com/kivitendo/kivitendo-erp/blob/fd3f993fc731cbcaa5eb87d55df7c82df4df9c09/doc/changelog","tags":["web"]},{"url":"https://github.com/kivitendo/kivitendo-erp/commit/1286dee72f9919166178d0cdb5f52f13b0f7d4de","tags":["fix"]},{"url":"https://github.com/kivitendo/kivitendo-erp/commit/f6ba56bd8d22a428534057589baace6b7bfdf2e9","tags":["fix"]},{"url":"https://blog.kivitendo.de/?p=1415","tags":["article"]},{"url":"https://invoice.secvuln.info","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-66370","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-6p6f-w7vp-pv39"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/66xxx/CVE-2025-66370.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2025-66370","description":"Kivitendo before 3.9.2 allows XXE injection. By uploading an electronic invoice in the ZUGFeRD format, it is possible to read and exfiltrate files from the server's filesystem.","status":"published","published":"2025-11-28T00:00:00Z","modified":"2026-01-15T06:46:24.375Z","cvss":[{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-611"],"updated_at":"2026-11-02T14:32:53.157279Z"}],"euvd":[{"id":"EUVD-2025-199851","description":"Kivitendo before 3.9.2 allows XXE injection. By uploading an electronic invoice in the ZUGFeRD format, it is possible to read and exfiltrate files from the server's filesystem.","status":"published","published":"2025-11-28T00:00:00Z","modified":"2026-01-15T06:46:24Z","cvss":[{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T19:48:51.744142Z"}],"ghsa":[{"id":"GHSA-6p6f-w7vp-pv39","title":"Kivitendo before 3.9.2 allows XXE injection. By uploading an electronic invoice in the ZUGFeRD...","description":"Kivitendo before 3.9.2 allows XXE injection. By uploading an electronic invoice in the ZUGFeRD format, it is possible to read and exfiltrate files from the server's filesystem.","status":"published","published":"2025-11-28T06:32:06Z","modified":"2026-01-15T09:34:22Z","cvss":[{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-611"],"updated_at":"2026-11-02T15:05:36.917125Z"}],"nvd":[{"id":"CVE-2025-66370","description":"Kivitendo before 3.9.2 allows XXE injection. By uploading an electronic invoice in the ZUGFeRD format, it is possible to read and exfiltrate files from the server's filesystem.","status":"published","published":"2025-11-28T04:16:01.11Z","modified":"2026-10-19T13:10:00.11Z","cvss":[{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-611"],"updated_at":"2026-11-02T14:11:46.94029Z"}],"osv":[{"id":"CVE-2025-66370","description":"Kivitendo before 3.9.2 allows XXE injection. By uploading an electronic invoice in the ZUGFeRD format, it is possible to read and exfiltrate files from the server's filesystem.","status":"published","published":"2025-11-28T00:00:00Z","modified":"2026-10-28T02:30:58.735578775Z","cvss":[{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-611"],"updated_at":"2026-11-02T15:44:52.202386Z"}]}}