xml2rfc versions prior to 3.34.0 contain a vulnerability that allows arbitrary file reads from the filesystem during PDF generation. This occurs when an attacker injects a malicious link element into the prepped RFCXML. The vulnerability has a high severity with a CVSS score of 8.7. A fix is available in version 3.34.0.