CVE-2026-4980: Improper Restriction of XML External Entity Reference in Inkscape
A local file disclosure vulnerability in the XInclude processing component of Inkscape 1.1 before 1.3 allows a remote attacker to read local files via a crafted SVG file containing malicious xi:include tags.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Inkscapeto a version that resolves this vulnerability.Fixed in 1.3
Event History
Frequently Asked Questions
What is the severity of CVE-2026-4980?
CVE-2026-4980 has been rated as a medium severity vulnerability due to the local file disclosure potential.
How do I fix CVE-2026-4980?
To fix CVE-2026-4980, update Inkscape to version 1.3 or later.
What types of software are affected by CVE-2026-4980?
CVE-2026-4980 affects Inkscape versions 1.1 to 1.2.999 inclusive.
What does CVE-2026-4980 exploit?
CVE-2026-4980 exploits improper restriction of XML External Entity reference in the XInclude processing component.
Can a remote attacker exploit CVE-2026-4980?
Yes, a remote attacker can exploit CVE-2026-4980 to read local files on an affected system.