{"id":"CVE-2025-11059","aliases":["GHSA-9mv7-3c64-mmqw","PYSEC-2026-2057"],"title":"xml2rfc is vulnerable to arbitrary file reads through prepped files","summary":"xml2rfc is vulnerable to arbitrary file reads through prepped files","severity":"high","vendor":"xml2rfc","product":"xml2rfc","ecosystem":"pip","affected":["xml2rfc < 3.30.2"],"patched":["xml2rfc 3.30.2"],"published":"2025-09-10","updated":"2026-07-07","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-9mv7-3c64-mmqw","references":[{"url":"https://github.com/ietf-tools/xml2rfc/security/advisories/GHSA-9mv7-3c64-mmqw"},{"url":"https://github.com/ietf-tools/xml2rfc/commit/73fb1c91fc62ac540bb6bd24f982f2becf84c1b0"},{"url":"https://github.com/ietf-tools/xml2rfc"},{"url":"https://github.com/ietf-tools/xml2rfc/releases/tag/v3.30.2"}],"tags":["osv","pip"],"ingestedAt":"2026-07-08T18:25:48.048Z","slug":"CVE-2025-11059","body":"## Overview\n\n### Impact\n\nWhen generating PDF files, this vulnerability allows an attacker to read arbitrary files from the filesystem by injecting malicious link element into the prepped RFCXML.\n\n### Workarounds\n\nTest untrusted input with `link` elements with `rel=\"attachment\"` before processing.\n\n### References\nThis is related to [GHSA-cfmv-h8fx-85m7](https://github.com/ietf-tools/xml2rfc/security/advisories/GHSA-cfmv-h8fx-85m7).\n\n## Affected packages\n\n- `xml2rfc < 3.30.2`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `xml2rfc 3.30.2`","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}