Bug 2391135 (CVE-2025-11058, GHSA-cfmv-h8fx-85m7)

Summary: CVE-2025-11058 xml2rfc: xml2rfc has an arbitrary file read vulnerability
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedKeywords: Security
Target Milestone: ---   
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in the PDF generation component of xml2rfc. This vulnerability allows an attacker to read arbitrary files from the filesystem via maliciously crafted link elements in XML input.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2399667, 2399668    
Bug Blocks:    

Description OSIDB Bzimport 2025-08-26 20:03:16 UTC 
### Impact
When generating PDF files, this vulnerability allows an attacker to read arbitrary files from the filesystem by injecting malicious link element into the XML.

### Workarounds
Test untrusted input with `link` elements with `rel="attachment"` before processing.

### Credits
This vulnerability was reported by Mohamed Ouad from [Doyensec](https://doyensec.com/).