xml2rfc versions prior to 3.34.0 have file inclusion irregularities where local file access restrictions are inconsistently enforced. Specifically, XML entity references can include files inside the source directory and below without requiring the --allow-local-file-access flag, and artwork or sourcecode elements with local file src attributes bypass this flag as well. This can lead to unintended disclosure of local files within the source directory when processing untrusted XML input. A fix in version 3.34.0 standardizes file access checks to restrict access appropriately.