What is GHSA-9mv7-3c64-mmqw?

GHSA-9mv7-3c64-mmqw is a security advisory published by GitHub Security Advisories with High severity. xml2rfc is vulnerable to arbitrary file reads through prepped files

Which CVE IDs does GHSA-9mv7-3c64-mmqw cover?

GHSA-9mv7-3c64-mmqw covers the following CVE IDs: CVE-2025-11059. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

Which products are affected by GHSA-9mv7-3c64-mmqw?

GHSA-9mv7-3c64-mmqw affects 1 product, including: pip/xml2rfc:\u003c 3.30.2.

GHSA-9mv7-3c64-mmqwHigh

xml2rfc is vulnerable to arbitrary file reads through prepped files

Vendor

GitHub Security Advisories

Published

September 10, 2025

Last Modified

September 29, 2025

🔗 CVE IDs covered (1)

CVE-2025-11059 →

📋 Description

Impact

When generating PDF files, this vulnerability allows an attacker to read arbitrary files from the filesystem by injecting malicious link element into the prepped RFCXML.

Workarounds

Test untrusted input with link elements with rel="attachment" before processing.

References

This is related to GHSA-cfmv-h8fx-85m7.

🎯 Affected products1

pip/xml2rfc:< 3.30.2

🔗 References (4)

https://github.com/ietf-tools/xml2rfc/security/advisories/GHSA-9mv7-3c64-mmqw
https://github.com/ietf-tools/xml2rfc/commit/73fb1c91fc62ac540bb6bd24f982f2becf84c1b0
https://github.com/ietf-tools/xml2rfc/releases/tag/v3.30.2
https://github.com/advisories/GHSA-9mv7-3c64-mmqw