PT-2025-36708 · Pypi · Xml2Rfc

Published 2025-08-26 · Updated 2025-08-26

OSV

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Impact

When generating PDF files, this vulnerability allows an attacker to read arbitrary files from the filesystem by injecting malicious link element into the XML.

Workarounds

Test untrusted input with link elements with rel="attachment" before processing.

Credits

This vulnerability was reported by Mohamed Ouad from Doyensec.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

GHSA-CFMV-H8FX-85M7

Affected Products

Xml2Rfc

References · 4

• https://osv.dev/vulnerability/GHSA-cfmv-h8fx-85m7 · Vendor Advisory
• https://github.com/ietf-tools/xml2rfc · Note
• https://github.com/ietf-tools/xml2rfc/commit/f2b245bc0aeeac0667c8f74e976c466c5991f0e4 · Note
• https://github.com/ietf-tools/xml2rfc/security/advisories/GHSA-cfmv-h8fx-85m7 · Note