https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 11 Nov 2026 00:50:13 +0000 https://db.gcve.eu/vuln/ghsa-432c-wxpg-m4q3 <p><strong>Affected:</strong> PyPI: xml2rfc</p> <p>Version [3.12.0](https://github.com/ietf-tools/xml2rfc/blob/main/CHANGELOG.md#3120---2021-12-08) changed `xml2rfc` so that it would not access local files without the presence of its new `--allow-local-file-access` flag. This prevented XML External Entity (XXE) injection attacks with `xinclude` and XML entity references.</p> <p>It was discovered that `xml2rfc` does not respect `--allow-local-file-access` when a local file is specified as `src` in `artwork` or `sourcecode` elements. Furthermore, XML entity references can include any file inside the source dir and below without using the `--allow-local-file-access` flag.</p> <p>The `xml2rfc &lt;= 3.26.0` behaviour:</p> <p>| | `xinclude` | XML entity reference | `artwork src=` | `sourcecode src=` | |---|---|---|---|---| | without `--allow-local-file-access` flag | No filesystem access | Any file in xml2rfc templates dir and below, any file in source directory and below | Access source directory and below | Access source directory and below | | with `--allow-local-file-access` flag | Access any file on filesystem[^1] | Access any file on filesystem[^1] | Access source directory and below | Access source directory and below | Access source directory and below |</p> <p>[^1]: Access any file of the filesystem with the permissions of the user running `xml2rfc` can access.</p> <p>### Impact</p> <p>Anyone running `xml2rfc` as a service that accepts input from external users is impacted by this issue. Specifying a file in `src` attribute in `artwork` or `sourcecode` ele…</p> <p><strong>Affected:</strong> PyPI: xml2rfc</p> <p>Version [3.12.0](https://github.com/ietf-tools/xml2rfc/blob/main/CHANGELOG.md#3120---2021-12-08) changed `xml2rfc` so that it would not access local files without the presence of its new `--allow-local-file-access` flag. This prevented XML External Entity (XXE) injection attacks with `xinclude` and XML entity references.</p> <p>It was discovered that `xml2rfc` does not respect `--allow-local-file-access` when a local file is specified as `src` in `artwork` or `sourcecode` elements. Furthermore, XML entity references can include any file inside the source dir and below without using the `--allow-local-file-access` flag.</p> <p>The `xml2rfc &lt;= 3.26.0` behaviour:</p> <p>| | `xinclude` | XML entity reference | `artwork src=` | `sourcecode src=` | |---|---|---|---|---| | without `--allow-local-file-access` flag | No filesystem access | Any file in xml2rfc templates dir and below, any file in source directory and below | Access source directory and below | Access source directory and below | | with `--allow-local-file-access` flag | Access any file on filesystem[^1] | Access any file on filesystem[^1] | Access source directory and below | Access source directory and below | Access source directory and below |</p> <p>[^1]: Access any file of the filesystem with the permissions of the user running `xml2rfc` can access.</p> <p>### Impact</p> <p>Anyone running `xml2rfc` as a service that accepts input from external users is impacted by this issue. Specifying a file in `src` attribute in `artwork` or `sourcecode` ele…</p> https://db.gcve.eu/vuln/ghsa-432c-wxpg-m4q3