PT-2025-39843 · Pypi · Xml2Rfc

Published 2025-09-10 · Updated 2025-09-10 · CVE-2025-11059

OSV

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Impact

When generating PDF files, this vulnerability allows an attacker to read arbitrary files from the filesystem by injecting malicious link element into the prepped RFCXML.

Workarounds

Test untrusted input with link elements with rel="attachment" before processing.

References

This is related to GHSA-cfmv-h8fx-85m7.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2025-11059

GHSA-9MV7-3C64-MMQW

Affected Products

Xml2Rfc

References · 5

• https://osv.dev/vulnerability/GHSA-9mv7-3c64-mmqw · Vendor Advisory
• https://github.com/ietf-tools/xml2rfc · Note
• https://github.com/ietf-tools/xml2rfc/releases/tag/v3.30.2 · Note
• https://github.com/ietf-tools/xml2rfc/commit/73fb1c91fc62ac540bb6bd24f982f2becf84c1b0 · Note
• https://github.com/ietf-tools/xml2rfc/security/advisories/GHSA-9mv7-3c64-mmqw · Note