Description
A vulnerability was detected in pkp pkp-lib up to 3.3.0-22/3.4.0-10/3.5.0-4. The affected element is the function _transformPHP of the file classes/xslt/XSLTransformer.php. The manipulation results in xml external entity reference. The attack can be executed remotely. Upgrading to version 3.3.0-23, 3.4.0-11 and 3.5.0-5 is sufficient to fix this issue. The patch is identified as 78c699370ea43ae2784e1c4ace7c947d207f2b47. Upgrading the affected component is advised.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
pkp pkp-lib
3.3.0-22affected3.4.0-10affected3.5.0-4affected3.3.0-23unaffected3.4.0-11unaffected3.5.0-5unaffected
References
- https://vuldb.com/vuln/393037 ↗
- https://vuldb.com/vuln/393037/cti ↗
- https://vuldb.com/cve/CVE-2026-76572 ↗
- https://vuldb.com/submit/878359 ↗
- https://github.com/pkp/pkp-lib/issues/12977 ↗
- https://github.com/pkp/pkp-lib/commit/78c699370ea43ae2784e1c4ace7c947d207f2b47 ↗
- https://github.com/pkp/pkp-lib/releases/tag/3_5_0-5 ↗
- https://github.com/pkp/pkp-lib/ ↗