← Back

CVE-2026-4980

nvd nist
Published: Mar 27, 2026Modified: Jun 17, 2026

JSON object

Loading...
6.3
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N
Exploitability: 1.8 / Impact: 4.0
Source: cve@gitlab.com (Secondary)

Description

A local file disclosure vulnerability in the XInclude processing component of Inkscape 1.1 before 1.3 allows a remote attacker to read local files via a crafted SVG file containing malicious xi:include tags.

Affected (1)

Products: Inkscape: Inkscape
Inkscape
1 product
Inkscape
Configuration A
1 vulnerable
Vulnerable SoftwareAffected Versions
Inkscape
From 1.1 to 1.3

Related CWEs

CWE-611
Improper Restriction of XML External Entity Reference
The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.

References (2)

Source: cve@gitlab.com
Issue TrackingPatch
Source: cve@gitlab.com
ExploitIssue Tracking

Timeline

No history available yet.