A vulnerability was found in Kivitendo up to 3.9.1. It has been declared as problematic. This impacts an unknown function of the component ZUGFeRD Handler. The manipulation results in xml external entity reference.
This vulnerability was named CVE-2025-66370. The attack may be performed from remote. There is no available exploit.
It is recommended to upgrade the affected component.
