High severityGHSA Advisory· Published Sep 10, 2025· Updated Sep 29, 2025
xml2rfc is vulnerable to arbitrary file reads through prepped files
CVE-2025-11059
Description
Impact
When generating PDF files, this vulnerability allows an attacker to read arbitrary files from the filesystem by injecting malicious link element into the prepped RFCXML.
Workarounds
Test untrusted input with link elements with rel="attachment" before processing.
References
This is related to GHSA-cfmv-h8fx-85m7.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
xml2rfcPyPI | < 3.30.2 | 3.30.2 |
Affected products
2- Range: < 3.30.2
Patches
Vulnerability mechanics
References
4News mentions
0No linked articles in our index yet.