oss-security - XXE vulnerabilities in electronic invoicing software (Kivitendo, peppol-py, ZUV)

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20251216101913.39107597@hboeck.de>
Date: Tue, 16 Dec 2025 10:19:13 +0100
From: Hanno Böck <hanno@...eck.de>
To: oss-security@...ts.openwall.com
Subject: XXE vulnerabilities in electronic invoicing software (Kivitendo,
 peppol-py, ZUV)

Hi,

I recently analyzed electronic invoicing software, and reported various
XXE vulnerabilities to affected software, including three open source
projects.

Kivitendo is a CRM software written in Perl. By uploading an electronic
invoice in XML format (ZUGFeRD/CII format), one was able to inject an
XXE payload that allows exfiltrating files from the system.
Fixed in Kivitendo 3.9.2, CVE-2025-66370
https://blog.kivitendo.de/?p=1415

peppol-py is a Python library and tool that allows validating invoices
and delivering them through the Peppol network.
The validation function was vulnerable to blind XXE, allowing
exfiltration of files (with the restriction that blind XXE only works
for files without newlines or special characters that will break in a
URL).
Fixed in peppol-py 1.1.1, CVE-2025-66371
https://github.com/iterasdev/peppol-py/releases/tag/1.1.1

ZUV is a tool to validate invoices in the ZUGFeRD standard. It is
vulnerable to blind XXE. ZUV is no longer developed, and this will not
be fixed. The ZUV developers recommend using the tool Mustang instead.
Mustang was also vulnerable to XXE in versions before 2.16.3
(CVE-2025-66372, not discovered by me, see GitHub issue):
https://github.com/ZUGFeRD/mustangproject/issues/685
https://github.com/ZUGFeRD/mustangproject/releases/tag/core-2.16.3

The vulnerabilities in ZUV and peppol-py are caused by insecure defaults
in the underlying library Saxon.

Proof of concept files for these vulnerabilities can be found here:
https://github.com/hannob/invoicesec

More info:
https://invoice.secvuln.info/

-- 
Hanno Böck - Independent security researcher
https://itsec.hboeck.de/
https://badkeys.info/

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.