---
id: CVE-2025-66371
title: Peppol-py before 1.1.1 allows XXE attacks because of the Saxon configuration
summary: >-
  Peppol-py before 1.1.1 allows XXE attacks because of the Saxon configuration.
  When validating XML-based invoices, the XML parser could read files from the
  filesystem and expose their content to a remote host.
severity: medium
cvss: 5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N'
cwe:
  - CWE-611
vendor: peppol-py
product: peppol-py
affected:
  - peppol-py < 1.1.1
patched:
  - peppol-py 1.1.1
published: '2025-11-28'
updated: '2026-10-08'
sourceUpdated: '2026-10-08T10:10:00.227'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-66371'
references:
  - url: >-
      https://github.com/iterasdev/peppol-py/commit/349a4bff8adb6205ea411bac8d7a06da0477abd7
    label: cve@mitre.org
  - url: 'https://github.com/iterasdev/peppol-py/pull/16'
    label: cve@mitre.org
  - url: 'https://github.com/iterasdev/peppol-py/releases/tag/1.1.1'
    label: cve@mitre.org
  - url: 'https://invoice.secvuln.info'
    label: cve@mitre.org
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2025-66371'
  - url: 'https://github.com/iterasdev/peppol-py'
tags:
  - nvd
  - osv
  - pip
epss: 0.00322
epssPercentile: 0.25082
aliases:
  - GHSA-24hm-wm2h-h8w7
  - PYSEC-2026-1765
ecosystem: pip
ingestedAt: '2026-07-08T18:25:44.134Z'
---

## Overview

Peppol-py before 1.1.1 allows XXE attacks because of the Saxon configuration. When validating XML-based invoices, the XML parser could read files from the filesystem and expose their content to a remote host.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2025-66371)

Affected packages:

- `peppol-py < 1.1.1`

Patched in:

- `peppol-py 1.1.1`

Source: https://osv.dev/vulnerability/GHSA-24hm-wm2h-h8w7