CVE-2011-1425: xslt.c in XML Security Library (aka xmlsec) before 1.2.17, as used in WebKit and other products, when XSLT...

Security readout for executives and security teams

A flaw in xmlsec before 1.2.17 can let a remote attacker create or overwrite files when vulnerable software verifies XML signatures with XSLT enabled. Business urgency is highest where untrusted XML documents are processed automatically by exposed services or embedded products. Exposure is most likely in applications, services, or embedded components that use xmlsec before 1.2.17 to verify XML digital signatures with XSLT enabled. Product-level exposure is incomplete in the bundle, so teams must inventory direct and bundled xmlsec usage. Prioritize remediation for internet-facing or automated XML-processing systems. For internal-only systems without XSLT-enabled signature verification, urgency is lower but inventory is still required because bundled xmlsec use may be hidden. Mitigation focus: Upgrade xmlsec to 1.2.17 or later where directly used.; Apply vendor security updates for packaged or bundled xmlsec consumers.; Review vendor advisories for WebKit or other products embedding xmlsec..

Prepared

Jun 24, 2026, 13:28 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.