GHSA-432c-wxpg-m4q3: 
Python vulnerability analysis and mitigation

A file inclusion vulnerability was discovered in xml2rfc versions 3.12.0 through 3.26.0. The issue stems from inconsistent handling of the --allow-local-file-access flag, particularly when local files are specified as src in artwork or sourcecode elements. Additionally, XML entity references could access files within the source directory without requiring the --allow-local-file-access flag, potentially leading to unauthorized file access (GitHub Advisory).

The vulnerability affects the file access control mechanism in xml2rfc. When processing XML files, the software does not properly enforce the --allow-local-file-access flag restrictions for artwork and sourcecode elements. Without the flag, XML entity references can still access any file in the xml2rfc templates directory and source directory. With the flag enabled, the software allows access to any file on the filesystem that the user running xml2rfc can access. The vulnerability has been assigned a CVSS v4.0 score of 6.9 (Moderate) with vector string CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N (GitHub Advisory).

The vulnerability primarily affects systems running xml2rfc as a service that accepts input from external users. When exploited, attackers can read the contents of files within the source directory through the src attribute in artwork or sourcecode elements. While the access is limited to files within the same directory as the XML input source file for artwork and sourcecode elements, it still presents a security risk for systems processing untrusted XML files (GitHub Advisory).

The vulnerability has been patched in version 3.27.0, which implements generalized file access checks and only allows access to files within the source directory and below. For users unable to upgrade immediately, the recommended workaround is to use a secure temporary directory to process untrusted XML files and avoid reusing it for processing other XML documents. The patch ensures that filesystem access is properly restricted based on the --allow-local-file-access flag setting (GitHub Commit).