Peppol-py XXE Vulnerability in XML Invoice Validation

A vulnerability allowing XML External Entity (XXE) attacks has been identified in Peppol-py versions prior to 1.1.1. This issue arises from the default configuration of the Saxon XML processor, which permits access to external resources. When validating XML-based invoices, the parser could be manipulated to read files from the filesystem and send their contents to a remote host.

Impact

Exploitation of this vulnerability allows for XXE attacks, where an attacker can read local files on the server and potentially send this data to an external location.

Remediation

Users can upgrade to Peppol-py version 1.1.1 or later, where this vulnerability has been fixed.