CVE-2026-4980: Inkscape File Disclosure Vulnerability

CVE-2026-4980 Overview

A local file disclosure vulnerability exists in the XInclude processing component of Inkscape versions 1.1 before 1.3. This XML External Entity (XXE) related flaw allows a remote attacker to read arbitrary local files by crafting a malicious SVG file containing specially crafted xi:include tags. When a victim opens the weaponized SVG file, the XInclude parser processes the embedded directives, potentially exposing sensitive system files to the attacker.

Critical Impact

Attackers can exfiltrate sensitive local files including configuration files, credentials, and other confidential data when a user opens a malicious SVG file in Inkscape.

Affected Products

• Inkscape 1.1.x
• Inkscape 1.2.x
• Inkscape versions prior to 1.3

Discovery Timeline

• 2026-03-27 - CVE CVE-2026-4980 published to NVD
• 2026-03-30 - Last updated in NVD database

Technical Details for CVE-2026-4980

Vulnerability Analysis

This vulnerability is classified as CWE-611 (Improper Restriction of XML External Entity Reference). The flaw resides in Inkscape's XInclude processing functionality, which fails to properly restrict file inclusion directives within SVG documents. XInclude is a mechanism for merging XML documents that allows including content from external resources. When Inkscape parses an SVG file containing malicious xi:include elements, it processes these directives without adequate validation, enabling attackers to reference and read local files on the victim's system.

The vulnerability requires local access and user interaction—specifically, the victim must open the malicious SVG file. However, the scope is changed because the vulnerability can affect resources beyond the vulnerable component, allowing disclosure of confidential information from files the Inkscape process has read access to.

Root Cause

The root cause is improper restriction of XML External Entity (XXE) references in Inkscape's XInclude processing component. The SVG parser does not adequately validate or sanitize xi:include tags before processing them, allowing arbitrary file paths to be specified and their contents to be included in the document processing flow. This enables an attacker to construct SVG files that, when opened, will read and potentially exfiltrate the contents of local files.

Attack Vector

The attack requires local access where a threat actor delivers a crafted SVG file to the victim through various means such as email attachments, file sharing, or downloads from malicious websites. When the victim opens the SVG file in a vulnerable version of Inkscape, the XInclude processor parses the embedded xi:include elements. These elements can specify local file paths using the href attribute, causing Inkscape to read the targeted files. The attacker can then retrieve the file contents through various exfiltration techniques embedded within the malicious document structure.

The vulnerability leverages the XInclude namespace (http://www.w3.org/2001/XInclude) and the xi:include element with an href attribute pointing to sensitive local files such as /etc/passwd, SSH keys, or application configuration files. For detailed technical information about the fix implementation, see the GitLab Merge Request.

Detection Methods for CVE-2026-4980

Indicators of Compromise

• Presence of SVG files containing xi:include or XInclude namespace declarations referencing local file paths
• Unexpected file access attempts by Inkscape processes to sensitive system files
• SVG documents with suspicious XInclude directives targeting configuration files, credentials, or system files

Detection Strategies

• Monitor for SVG files containing the XInclude namespace (http://www.w3.org/2001/XInclude) or xi:include tags with href attributes pointing to local file paths
• Implement file integrity monitoring on sensitive configuration files to detect unauthorized read access
• Deploy endpoint detection rules to alert on Inkscape processes accessing sensitive directories outside normal operation

Monitoring Recommendations

• Enable detailed logging for file access events by Inkscape and related processes
• Monitor email gateways and file sharing services for SVG files containing XInclude directives
• Implement network monitoring to detect potential data exfiltration attempts following SVG file processing

How to Mitigate CVE-2026-4980

Immediate Actions Required

• Upgrade Inkscape to version 1.3 or later where the XInclude processing vulnerability has been addressed
• Avoid opening untrusted SVG files from unknown or suspicious sources
• Review and audit any SVG files received from external parties before opening

Patch Information

The vulnerability has been addressed in Inkscape version 1.3. Users should update to this version or later to remediate the issue. Technical details about the fix are available in the GitLab Merge Request #5269 and the GitLab Work Item #3557.

Workarounds

• Configure endpoint protection to scan and quarantine SVG files containing XInclude directives before they reach end users
• Implement file type policies that restrict or sanitize SVG files from untrusted sources
• Use sandboxed environments or virtual machines when processing SVG files from untrusted sources
• Consider using alternative SVG editors for processing untrusted files until patching is complete

# Example: Scan SVG files for suspicious XInclude patterns before opening
grep -r "xi:include\|XInclude" *.svg
# Review any matches before opening files in Inkscape