{"id":"CVE-2025-66370","details":"Kivitendo before 3.9.2 allows XXE injection. By uploading an electronic invoice in the ZUGFeRD format, it is possible to read and exfiltrate files from the server's filesystem.","modified":"2026-08-12T03:51:20.440792580Z","published":"2025-11-28T00:00:00Z","database_specific":{"cwe_ids":["CWE-611"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/66xxx/CVE-2025-66370.json","cna_assigner":"mitre"},"references":[{"type":"WEB","url":"https://github.com/kivitendo/kivitendo-erp/blob/fd3f993fc731cbcaa5eb87d55df7c82df4df9c09/doc/changelog"},{"type":"WEB","url":"https://invoice.secvuln.info"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/66xxx/CVE-2025-66370.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-66370"},{"type":"FIX","url":"https://github.com/kivitendo/kivitendo-erp/commit/1286dee72f9919166178d0cdb5f52f13b0f7d4de"},{"type":"FIX","url":"https://github.com/kivitendo/kivitendo-erp/commit/f6ba56bd8d22a428534057589baace6b7bfdf2e9"},{"type":"ARTICLE","url":"https://blog.kivitendo.de/?p=1415"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/kivitendo/kivitendo-erp","events":[{"introduced":"0"},{"fixed":"30dcb889d5e705bd2958b81a6deb97f4ce9ff385"},{"fixed":"1286dee72f9919166178d0cdb5f52f13b0f7d4de"},{"fixed":"f6ba56bd8d22a428534057589baace6b7bfdf2e9"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"fixed":"3.9.2"}],"source":["DESCRIPTION","REFERENCES"]}}],"versions":["release-3.9.2beta2","release-3.9.1","release-3.9.0","release-3.9.0beta","release-3.8.0","release-3.8.0beta","release-3.7.0","release-3.6.1","release-3.6.0","release-3.6.0beta","release-3.5.8","release-3.5.7","release-3.5.6.1","release-3.5.6","release-3.5.5","release-3.5.4","release-3.5.4beta","release-3.5.3","release-3.5.2","release-3.5.1","release-3.5.1beta","release-3.5.0","release-3.5.0beta","release-3.5.0alpha","release-3.4.1","release-3.4.0","release-3.3.0","release-3.3.0beta","release-3.2.1","release-3.2.0","release-3.2.0beta","release-3.1.0rc1","release-3.1.0beta1","release-3.0.0","release-3.0.0rc1","release-3.0.0beta3","release-3.0.0beta2","release-2.7.0beta2","release-2.6.3","release-2.6.2","release-2.6.2beta2","release-2.6.2beta1","release-2.6.1","release-2.6.1beta1","release-2.6.0","release-2.6.0rc1","release-2.6.0beta1","release-2.4.2"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-66370.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N"}]}