AIKIDO-2026-275773

TL;DR

The OpenDocument backend resolves the xlink:href attribute of a draw:image element as a filesystem path when the referenced image is not found inside the document archive. A crafted OpenDocument file can point that reference at an absolute local path, and the backend reads the file and embeds its bytes into the converted output. Before the fix this happens regardless of the enable_local_fetch and enable_remote_fetch settings and lets document content alone read arbitrary local files such as /etc/passwd. The fix resolves external image references through ImageResourceLoader so the fetch toggles are enforced and rejects extension-less paths.