TYPO3 Core

in file
/typo3/sysext/seo/Classes/XmlSitemap/XmlSitemapRenderer.php
the path to the xsl file is hard coded:

public function __construct()
{
    $this->configuration = $this->getConfiguration();
    $this->view = $this->getStandaloneView();
    $this->view->assign(
        'xslFile',
        PathUtility::stripPathSitePrefix(
            ExtensionManagementUtility::extPath('seo', 'Resources/Public/CSS/Sitemap.xsl')
        )
    );
}

result is that the xml sitemap refers to a xsl file which locates in the /typo3/sysext/ folder in frontend context. Many installations protect the typo3 folder from the public web with passwords. This results in an error 500 when the sitemap is called.

In my opinion a direct call to the /typo3/ folder in frontend context should be considered as a bug.