---
id: CVE-2025-66371
aliases:
  - GHSA-24hm-wm2h-h8w7
  - PYSEC-2026-1765
title: Peppol-py is vulnerable to XXE attacks due to Saxon configuration
summary: Peppol-py is vulnerable to XXE attacks due to Saxon configuration
severity: medium
cvss: 5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N'
vendor: peppol-py
product: peppol-py
ecosystem: pip
affected:
  - peppol-py < 1.1.1
patched:
  - peppol-py 1.1.1
published: '2025-11-28'
updated: '2026-07-07'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-24hm-wm2h-h8w7'
references:
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2025-66371'
  - url: 'https://github.com/iterasdev/peppol-py/pull/16'
  - url: >-
      https://github.com/iterasdev/peppol-py/commit/349a4bff8adb6205ea411bac8d7a06da0477abd7
  - url: 'https://github.com/iterasdev/peppol-py'
  - url: 'https://github.com/iterasdev/peppol-py/releases/tag/1.1.1'
  - url: 'https://invoice.secvuln.info'
tags:
  - osv
  - pip
epss: 0.00322
epssPercentile: 0.22524
ingestedAt: '2026-07-08T18:25:44.134Z'
---

## Overview

Peppol-py before 1.1.1 allows XXE attacks because of the Saxon configuration. When validating XML-based invoices, the XML parser could read files from the filesystem and expose their content to a remote host.

## Affected packages

- `peppol-py < 1.1.1`

## Remediation

Upgrade to a patched release:

- `peppol-py 1.1.1`