CVE-2025-11058
xml2rfc has an arbitrary file read vulnerability
Impact
When generating PDF files, this vulnerability allows an attacker to read arbitrary files from the filesystem by injecting malicious link element into the XML.
Workarounds
Test untrusted input with link elements with rel="attachment" before processing.
Credits
This vulnerability was reported by Mohamed Ouad from Doyensec.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
What each source reports
GitHub Advisories Score usedGHSA-cfmv-h8fx-85m7
xml2rfc has an arbitrary file read vulnerability
Impact
When generating PDF files, this vulnerability allows an attacker to read arbitrary files from the filesystem by injecting malicious link element into the XML.
Workarounds
Test untrusted input with link elements with rel="attachment" before processing.
Credits
This vulnerability was reported by Mohamed Ouad from Doyensec.
- Record
GHSA-cfmv-h8fx-85m7- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N - Weakness
- CWE-22
- Updated
- 2026-11-02
OSVGHSA-cfmv-h8fx-85m7
xml2rfc has an arbitrary file read vulnerability
Impact
When generating PDF files, this vulnerability allows an attacker to read arbitrary files from the filesystem by injecting malicious link element into the XML.
Workarounds
Test untrusted input with link elements with rel="attachment" before processing.
Credits
This vulnerability was reported by Mohamed Ouad from Doyensec.
- Record
GHSA-cfmv-h8fx-85m7- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N - Weakness
- CWE-22
- Updated
- 2026-11-02
OSVPYSEC-2026-2058
xml2rfc has an arbitrary file read vulnerability
Impact
When generating PDF files, this vulnerability allows an attacker to read arbitrary files from the filesystem by injecting malicious link element into the XML.
Workarounds
Test untrusted input with link elements with rel="attachment" before processing.
Credits
This vulnerability was reported by Mohamed Ouad from Doyensec.
- Record
PYSEC-2026-2058- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N - Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
xml2rfcPyPI |
through 3.30.0 | 3.30.1 |
xml2rfcPyPI |
before 3.30.1, plus listed versions 2.10.02.10.12.10.22.10.32.11.0 Show 45 moreShow less2.11.12.12.02.12.12.12.22.12.32.13.02.13.12.14.02.14.12.15.02.15.12.15.22.15.32.15.42.15.52.16.02.16.12.16.22.16.32.17.02.17.12.17.22.18.02.19.02.19.12.2.52.2.72.20.02.20.12.21.02.21.12.22.02.22.12.22.22.22.32.23.02.23.12.24.02.25.02.26.02.27.02.27.12.28.02.29.02.29.1 |
3.30.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2025-11058 is a high vulnerability (CVSS 8.7) in xml2rfc, published August 26, 2025. No source lists public exploit code. Fixed in xml2rfc 3.30.1.
References
Left out here: 145 versions. The JSON record has them.