CVE-2025-11059
xml2rfc is vulnerable to arbitrary file reads through prepped files
Impact
When generating PDF files, this vulnerability allows an attacker to read arbitrary files from the filesystem by injecting malicious link element into the prepped RFCXML.
Workarounds
Test untrusted input with link elements with rel="attachment" before processing.
References
This is related to GHSA-cfmv-h8fx-85m7.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
What each source reports
GitHub Advisories Score usedGHSA-9mv7-3c64-mmqw
xml2rfc is vulnerable to arbitrary file reads through prepped files
Impact
When generating PDF files, this vulnerability allows an attacker to read arbitrary files from the filesystem by injecting malicious link element into the prepped RFCXML.
Workarounds
Test untrusted input with link elements with rel="attachment" before processing.
References
This is related to GHSA-cfmv-h8fx-85m7.
- Record
GHSA-9mv7-3c64-mmqw- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N - Weakness
- CWE-22
- Updated
- 2026-11-02
OSVGHSA-9mv7-3c64-mmqw
xml2rfc is vulnerable to arbitrary file reads through prepped files
Impact
When generating PDF files, this vulnerability allows an attacker to read arbitrary files from the filesystem by injecting malicious link element into the prepped RFCXML.
Workarounds
Test untrusted input with link elements with rel="attachment" before processing.
References
This is related to GHSA-cfmv-h8fx-85m7.
- Record
GHSA-9mv7-3c64-mmqw- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N - Weakness
- CWE-22
- Updated
- 2026-11-02
OSVPYSEC-2026-2057
xml2rfc is vulnerable to arbitrary file reads through prepped files
Impact
When generating PDF files, this vulnerability allows an attacker to read arbitrary files from the filesystem by injecting malicious link element into the prepped RFCXML.
Workarounds
Test untrusted input with link elements with rel="attachment" before processing.
References
This is related to GHSA-cfmv-h8fx-85m7.
- Record
PYSEC-2026-2057- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N - Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
xml2rfcPyPI |
before 3.30.2 | 3.30.2 |
xml2rfcPyPI |
before 3.30.2, plus listed versions 2.10.02.10.12.10.22.10.32.11.0 Show 45 moreShow less2.11.12.12.02.12.12.12.22.12.32.13.02.13.12.14.02.14.12.15.02.15.12.15.22.15.32.15.42.15.52.16.02.16.12.16.22.16.32.17.02.17.12.17.22.18.02.19.02.19.12.2.52.2.72.20.02.20.12.21.02.21.12.22.02.22.12.22.22.22.32.23.02.23.12.24.02.25.02.26.02.27.02.27.12.28.02.29.02.29.1 |
3.30.2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2025-11059 is a high vulnerability (CVSS 8.7) in xml2rfc, published September 10, 2025. No source lists public exploit code. Fixed in xml2rfc 3.30.2.
References
github.com/ietf-tools/xml2rfc/security/advisories/GHSA-9mv7-3c64-mmqw
pypi.org/project/xml2rfc
nvd.nist.gov/vuln/detail/CVE-2025-11059
Left out here: 146 versions. The JSON record has them.