—

PYSEC-2026-2057

xml2rfc is vulnerable to arbitrary file reads through prepped files

Quick fix

PYSEC-2026-2057 — xml2rfc: upgrade to the fixed version with the command below.

pip install --upgrade 'xml2rfc>=3.30.2'

Details

### Impact

When generating PDF files, this vulnerability allows an attacker to read arbitrary files from the filesystem by injecting malicious link element into the prepped RFCXML.

### Workarounds

Test untrusted input with `link` elements with `rel="attachment"` before processing.

### References This is related to [GHSA-cfmv-h8fx-85m7](https://github.com/ietf-tools/xml2rfc/security/advisories/GHSA-cfmv-h8fx-85m7).

Are you affected?

Enter the version of the package you're using.

Affected packages

PyPI/xml2rfc

Introduced in: 0Fixed in: 3.30.2

Fixpip install --upgrade 'xml2rfc>=3.30.2'

References

https://github.com/ietf-tools/xml2rfc/security/advisories/GHSA-9mv7-3c64-mmqw[WEB]
https://github.com/ietf-tools/xml2rfc/commit/73fb1c91fc62ac540bb6bd24f982f2becf84c1b0[WEB]
https://github.com/ietf-tools/xml2rfc[PACKAGE]
https://github.com/ietf-tools/xml2rfc/releases/tag/v3.30.2[WEB]
https://pypi.org/project/xml2rfc[PACKAGE]
https://github.com/advisories/GHSA-9mv7-3c64-mmqw[ADVISORY]
https://nvd.nist.gov/vuln/detail/CVE-2025-11059[ADVISORY]