Kivitendo before 3.9.2 allows XXE injection. By uploading an electronic invoice in the ZUGFeRD format, it is possible to read and exfiltrate files fro...

Original description

The description as published by the source.

Source: OSV.dev (Open Source Vulnerabilities) NVD OSV

References

• advisory github.com
• advisory nvd.nist.gov
• patch github.com
• patch github.com
• web github.com
• web invoice.secvuln.info
• web blog.kivitendo.de