CVE-2025-66371
BaseFortify
Publication date: 2025-11-28
Last updated on: 2025-11-28
Assigner: MITRE
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| peppol | peppol-py | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-611 | The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability in peppol-py before version 1.1.1 allows XML External Entity (XXE) attacks due to the Saxon configuration. Specifically, when validating XML-based invoices, the XML parser can be tricked into reading files from the local filesystem and exposing their contents to a remote attacker.
How can this vulnerability impact me? :
An attacker exploiting this vulnerability could gain access to sensitive files on the system where peppol-py is running by tricking the XML parser into disclosing file contents remotely. This could lead to information disclosure and potential data breaches.