{"id":"CVE-2025-66371","title":"Peppol-py before 1.1.1 allows XXE attacks because of the Saxon configuration","summary":"Peppol-py before 1.1.1 allows XXE attacks because of the Saxon configuration. When validating XML-based invoices, the XML parser could read files from the filesystem and expose their content to a remote host.","severity":"medium","cvss":5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N","cwe":["CWE-611"],"vendor":"peppol-py","product":"peppol-py","affected":["peppol-py < 1.1.1"],"patched":["peppol-py 1.1.1"],"published":"2025-11-28","updated":"2026-10-08","sourceUpdated":"2026-10-08T10:10:00.227","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-66371","references":[{"url":"https://github.com/iterasdev/peppol-py/commit/349a4bff8adb6205ea411bac8d7a06da0477abd7","label":"cve@mitre.org"},{"url":"https://github.com/iterasdev/peppol-py/pull/16","label":"cve@mitre.org"},{"url":"https://github.com/iterasdev/peppol-py/releases/tag/1.1.1","label":"cve@mitre.org"},{"url":"https://invoice.secvuln.info","label":"cve@mitre.org"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-66371"},{"url":"https://github.com/iterasdev/peppol-py"}],"tags":["nvd","osv","pip"],"epss":0.00322,"epssPercentile":0.25082,"aliases":["GHSA-24hm-wm2h-h8w7","PYSEC-2026-1765"],"ecosystem":"pip","ingestedAt":"2026-07-08T18:25:44.134Z","slug":"CVE-2025-66371","body":"## Overview\n\nPeppol-py before 1.1.1 allows XXE attacks because of the Saxon configuration. When validating XML-based invoices, the XML parser could read files from the filesystem and expose their content to a remote host.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Package advisory (CVE-2025-66371)\n\nAffected packages:\n\n- `peppol-py < 1.1.1`\n\nPatched in:\n\n- `peppol-py 1.1.1`\n\nSource: https://osv.dev/vulnerability/GHSA-24hm-wm2h-h8w7","depth":"sunlit","depthScore":28,"depthScoreParts":{"impact":27.5,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}