CVE-2025-66371 Peppol-py is vulnerable to XXE attacks due to Saxon configuration
An attacker can exploit an XML External Entity vulnerability in Peppol-py to read local files and expose their content to a remote host.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-66371?
CVE-2025-66371 is a medium-severity vulnerability in Iteras Peppol-py, published on 28 Nov 2025. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Peppol-py before 1.1.1 allows XXE attacks because of the Saxon configuration. When validating XML-based invoices, the XML parser could read files from the filesystem and expose their content to a remote host.
Weakness: CWE-611
Which versions are affected by CVE-2025-66371?
3 open source packages ship an affected version, including peppol-py and peppol_py.
| Package | Affected | Fixed in |
|---|---|---|
peppol-py PyPI | All versions | 1.1.1 |
peppol-py PyPI | All versions | 1.1.1 |
peppol_py PyPI | All versions | 1.1.1 |
How do I fix CVE-2025-66371?
Upgrade peppol-py to 1.1.1 or later.
Is CVE-2025-66371 being exploited?
There is no known exploitation of CVE-2025-66371 in the wild and no public exploit code.
Sources
Also known as GHSA-24hm-wm2h-h8w7, PYSEC-2026-1765.