---
id: CVE-2026-4980
title: Improper Restriction of XML External Entity Reference in Inkscape
summary: >-
  A local file disclosure vulnerability in the XInclude processing component of
  Inkscape 1.1 before 1.3 allows a remote attacker to read local files via a
  crafted SVG file containing malicious xi:include tags.
severity: medium
cvss: 6.3
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N'
cvssSource: cna
cwe:
  - CWE-611
vendor: Inkscape
product: Inkscape
affected:
  - Inkscape >= 1.1 < 1.3
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-03-27T15:12:52.453006Z'
exploitAvailable: true
published: '2026-03-27'
updated: '2026-10-26'
sourceUpdated: '2026-10-26T18:10:37.229Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-4980'
references:
  - url: 'https://gitlab.com/inkscape/inkscape/-/work_items/3557'
  - url: 'https://gitlab.com/inkscape/inkscape/-/merge_requests/5269'
tags:
  - cve.org
  - exploit-available
epss: 0.00241
epssPercentile: 0.15205
ingestedAt: '2026-10-26T18:35:51.490Z'
---

## Overview

A local file disclosure vulnerability in the XInclude processing component of Inkscape 1.1 before 1.3 allows a remote attacker to read local files via a crafted SVG file containing malicious xi:include tags.

## Affected

- `Inkscape >= 1.1 < 1.3`

## Remediation

Upgrade to version 1.3 or above