{"id":"CVE-2025-66371","aliases":["GHSA-24hm-wm2h-h8w7","PYSEC-2026-1765"],"title":"Peppol-py is vulnerable to XXE attacks due to Saxon configuration","summary":"Peppol-py is vulnerable to XXE attacks due to Saxon configuration","severity":"medium","cvss":5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N","vendor":"peppol-py","product":"peppol-py","ecosystem":"pip","affected":["peppol-py < 1.1.1"],"patched":["peppol-py 1.1.1"],"published":"2025-11-28","updated":"2026-07-07","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-24hm-wm2h-h8w7","references":[{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-66371"},{"url":"https://github.com/iterasdev/peppol-py/pull/16"},{"url":"https://github.com/iterasdev/peppol-py/commit/349a4bff8adb6205ea411bac8d7a06da0477abd7"},{"url":"https://github.com/iterasdev/peppol-py"},{"url":"https://github.com/iterasdev/peppol-py/releases/tag/1.1.1"},{"url":"https://invoice.secvuln.info"}],"tags":["osv","pip"],"epss":0.00322,"epssPercentile":0.25494,"ingestedAt":"2026-07-08T18:25:44.134Z","slug":"CVE-2025-66371","body":"## Overview\n\nPeppol-py before 1.1.1 allows XXE attacks because of the Saxon configuration. When validating XML-based invoices, the XML parser could read files from the filesystem and expose their content to a remote host.\n\n## Affected packages\n\n- `peppol-py < 1.1.1`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `peppol-py 1.1.1`","depth":"sunlit","depthScore":28,"depthScoreParts":{"impact":27.5,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}