What is CVE-2012-5656?

CVE-2012-5656 is a medium-severity vulnerability in Inkscape, classified under Improper Restriction of XML External Entity Reference (XXE). CVSS score: 5.5/10. Published 2013-01-18.

How severe is CVE-2012-5656?

Medium severity. CVSS v3 base score is 5.5 out of 10.

XXE in Inkscape

CVE-2012-5656

The rasterization process in Inkscape before 0.48.4 allows local users to read arbitrary files via an external entity in a SVG file, aka an XML external entity (XXE) injection attack.

Vulnerability class: XXE (XML External Entity)

Published 2013-01-18 · last modified 2026-06-16.

CVSS v3 metric

CVSS v3 base score 5.5 (Medium). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N.

EPSS exploit prediction

EPSS: 0.012 (67.0th percentile), scored 2026-11-01.

Low probability of exploitation in the next 30 days, but still tracked. 67th percentile — 67.0% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.012 · newest: 0.012 · change: 0.000

Affected products

Inkscape
Canonical Ubuntu Linux — versions 10.04, 11.10, 12.04
Fedoraproject Fedora — versions 16, 17, 18
openSUSE — versions 11.4, 12.1, 12.2

Weakness classification (CWE)

CWE-611 — Improper Restriction of XML External Entity Reference (XXE)

References

www.openwall.com/lists/oss-security/2012/12/20/3 (mailing-list, Exploit, Mailing List)
lists.fedoraproject.org/pipermail/package-announce/2013-January/095380.html (vendor-advisory, Mailing List)
bazaar.launchpad.net/~inkscape.dev/inkscape/trunk/revision/11931 (Patch)
www.ubuntu.com/usn/USN-1712-1 (vendor-advisory, Third Party Advisory)
launchpad.net/inkscape/+milestone/0.48.4 (Product)
www.securityfocus.com/bid/56965 (VDB Entry, Third Party Advisory, vdb-entry, Broken Link)
bugs.launchpad.net/inkscape/+bug/1025185 (Exploit, Issue Tracking)
lists.fedoraproject.org/pipermail/package-announce/2013-January/095398.html (vendor-advisory, Mailing List)
lists.opensuse.org/opensuse-updates/2013-02/msg00041.html (vendor-advisory, Mailing List)
lists.opensuse.org/opensuse-updates/2013-02/msg00043.html (vendor-advisory, Mailing List)

Frequently asked questions

What is CVE-2012-5656?: CVE-2012-5656 is a medium-severity vulnerability in Inkscape, classified under Improper Restriction of XML External Entity Reference (XXE). CVSS score: 5.5/10. Published 2013-01-18.
How severe is CVE-2012-5656?: Medium severity. CVSS v3 base score is 5.5 out of 10.