CVE-2011-1425: Aleksey XML Security Library

Medium severity, CVSS 5.1. EPSS: 8.1% chance of exploitation in the next 30 days.

xslt.c in XML Security Library (aka xmlsec) before 1.2.17, as used in WebKit and other products, when XSLT is enabled, allows remote attackers to create or overwrite arbitrary files via vectors involving the libxslt output extension and a ds:Transform element during signature verification.

Affected products

• Aleksey XML Security Library: up to and including 1.2.16; version 0.0.1 only; version 0.0.2 only; version 0.0.2a only; version 0.0.3 only; version 0.0.4 only; …
• Apple Webkit: any version

Published 2011-04-04. Last modified 2026-06-16.