Security Advisory
CVE-2025-66370
5
MEDIUM
Vulnerability Description
Kivitendo before 3.9.2 allows XXE injection. By uploading an electronic invoice in the ZUGFeRD format, it is possible to read and exfiltrate files from the server's filesystem.
Published Date
November 28, 2025
Official Source
NIST NVD Advisory