XML Eexternal Entity (XXE) Injection

tuxguitar is vulnerable to XML Eexternal Entity (XXE) Injection. An attacker is able to exploit a flaw in the way that TuxGuitar parses XML files to load GP6 and GP7 tablature files. The attacker can then trick a user into opening a specially crafted GP6 or GP7 file, which would cause TuxGuitar to load the file and gain access to data contained within the file.