CVE-2025-11058: xml2rfc Arbitrary File Read Vulnerability
Summary
CVE-2025-11058: xml2rfc has an arbitrary file read vulnerability. Affects xml2rfc versions < 3.30.1. Fixed in 3.30.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
xml2rfc is a Python package used for generating RFC documents in various formats, including PDF. It allows users to create structured documents using XML syntax. The package is widely utilized in technical documentation and standards development. However, it has been found to have a vulnerability that can be exploited to read arbitrary files from the filesystem, posing a significant security risk.
Vulnerability Detail
The vulnerability arises when generating PDF files from XML input. An attacker can inject a malicious link element into the XML, which can lead to unauthorized access to files on the server's filesystem. This could potentially expose sensitive information and compromise the integrity of the system. The vulnerability is classified with a CVSS score of 8.7, indicating a high severity level.
How To Fix
Latest published version: 3.34.1 as of 23 Oct 2026
pip install --upgrade "xml2rfc==3.34.1"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.30.1
This is the first release that contains the fix.
pip install --upgrade "xml2rfc==3.30.1"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, validate any untrusted input containing link elements with rel="attachment" before processing. This can help prevent the execution of malicious links that could lead to file reading vulnerabilities.
Conclusion
The xml2rfc package has a critical vulnerability that allows arbitrary file reading through malicious XML input. Users are strongly advised to update to the latest version to protect their systems. Implementing the suggested workaround can provide temporary relief until the update is applied.
See every vulnerability recorded for xml2rfc →
FAQ
The vulnerability allows an attacker to read arbitrary files from the filesystem by injecting malicious link elements into the XML used for generating PDFs.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
If immediate updates are not possible, implement the recommended workaround by validating untrusted input with link elements before processing.
The CVSS score of this vulnerability is 8.7, indicating a high severity level.
This vulnerability was reported by Mohamed Ouad from Doyensec.
References
Related vulnerabilities
Recent vulnerabilities recorded for xml2rfc.
