Kivitendo XXE Injection Vulnerability Allowing File Exfiltration
Vulnerability
A vulnerability allowing XML External Entity (XXE) injection has been identified in Kivitendo versions prior to 3.9.2. This issue arises when uploading electronic invoices in the ZUGFeRD format, which can be exploited to read and exfiltrate files from the server's filesystem.
Impact
Exploitation of this vulnerability could lead to unauthorized access and exfiltration of files from the server's filesystem.
Remediation
Users can upgrade to Kivitendo version 3.9.2 or later to address this vulnerability.
Added: Nov 28, 2025, 4:21 AM
Updated: Nov 28, 2025, 4:21 AM
Vulnerability Rating
Custom Algorithm
spread
0.0impact
2.5exploitability
5.7remediation
0.0relevance
1.3threat
3.2urgency
2.9incentive
1.7Our algorithm analyzes dozens of metrics to generate these 8 key vulnerability categories, which are then combined to calculate the overall risk score.