What is GHSA-cfmv-h8fx-85m7?

GHSA-cfmv-h8fx-85m7 is a security advisory published by GitHub Security Advisories with High severity. xml2rfc has an arbitrary file read vulnerability

Which CVE IDs does GHSA-cfmv-h8fx-85m7 cover?

GHSA-cfmv-h8fx-85m7 covers the following CVE IDs: CVE-2025-11058. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

Which products are affected by GHSA-cfmv-h8fx-85m7?

GHSA-cfmv-h8fx-85m7 affects 1 product, including: pip/xml2rfc:\u003c= 3.30.0.

GHSA-cfmv-h8fx-85m7High

xml2rfc has an arbitrary file read vulnerability

Vendor

GitHub Security Advisories

Published

August 26, 2025

Last Modified

September 29, 2025

🔗 CVE IDs covered (1)

CVE-2025-11058 →

📋 Description

Impact

When generating PDF files, this vulnerability allows an attacker to read arbitrary files from the filesystem by injecting malicious link element into the XML.

Workarounds

Test untrusted input with link elements with rel="attachment" before processing.

Credits

This vulnerability was reported by Mohamed Ouad from Doyensec.

🎯 Affected products1

pip/xml2rfc:<= 3.30.0

🔗 References (3)

https://github.com/ietf-tools/xml2rfc/security/advisories/GHSA-cfmv-h8fx-85m7
https://github.com/ietf-tools/xml2rfc/commit/f2b245bc0aeeac0667c8f74e976c466c5991f0e4
https://github.com/advisories/GHSA-cfmv-h8fx-85m7