id: PYSEC-2026-1765
published: "2026-07-07T16:03:11.009339Z"
modified: "2026-07-07T17:25:00.417833Z"
aliases:
- CVE-2025-66371
- GHSA-24hm-wm2h-h8w7
summary: Peppol-py is vulnerable to XXE attacks due to Saxon configuration
details: Peppol-py before 1.1.1 allows XXE attacks because of the Saxon configuration. When validating XML-based invoices, the XML parser could read files from the filesystem and expose their content to a remote host.
affected:
- package:
    name: peppol-py
    ecosystem: PyPI
    purl: pkg:pypi/peppol-py
  ranges:
  - type: ECOSYSTEM
    events:
    - introduced: "0"
    - fixed: 1.1.1
  versions:
  - 1.0.0
  - 1.1.0
references:
- type: ADVISORY
  url: https://nvd.nist.gov/vuln/detail/CVE-2025-66371
- type: WEB
  url: https://github.com/iterasdev/peppol-py/pull/16
- type: WEB
  url: https://github.com/iterasdev/peppol-py/commit/349a4bff8adb6205ea411bac8d7a06da0477abd7
- type: PACKAGE
  url: https://github.com/iterasdev/peppol-py
- type: WEB
  url: https://github.com/iterasdev/peppol-py/releases/tag/1.1.1
- type: WEB
  url: https://invoice.secvuln.info
- type: PACKAGE
  url: https://pypi.org/project/peppol-py
- type: ADVISORY
  url: https://github.com/advisories/GHSA-24hm-wm2h-h8w7
severity:
- type: CVSS_V3
  score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N