CVE-2025-66370

Kivitendo before 3.9.2 allows XXE injection. By uploading an electronic invoice in the ZUGFeRD format, it is possible to read and exfiltrate files from the server's filesystem.

CVSS 3.1

5.0CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

EPSS

0.3% chance of exploitation in the next 30 days; higher than 25% of CVEs (scores of 2026-10-25)

CWE

CWE-611

Published

2025-11-28

Modified

2026-10-19

Record from

the NVD, synced 2026-10-19

References

• https://blog.kivitendo.de/?p=1415
• https://github.com/kivitendo/kivitendo-erp/blob/fd3f993fc731cbcaa5eb87d55df7c82df4df9c09/doc/changelog
• https://github.com/kivitendo/kivitendo-erp/commit/1286dee72f9919166178d0cdb5f52f13b0f7d4de
• https://github.com/kivitendo/kivitendo-erp/commit/f6ba56bd8d22a428534057589baace6b7bfdf2e9
• https://invoice.secvuln.info

Check your stackJSON