Description

A vulnerability was detected in pkp pkp-lib up to 3.3.0-22/3.4.0-10/3.5.0-4. The affected element is the function _transformPHP of the file classes/xslt/XSLTransformer.php. The manipulation results in xml external entity reference. The attack can be executed remotely. Upgrading to version 3.3.0-23, 3.4.0-11 and 3.5.0-5 is sufficient to fix this issue. The patch is identified as 78c699370ea43ae2784e1c4ace7c947d207f2b47. Upgrading the affected component is advised.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.7",
  "pubDate": "2026-08-19T20:17:23.627Z",
  "pubdate": "2026-08-19T20:17:23.627Z",
  "executiveSummary": "An XML External Entity (XXE) vulnerability has been identified in pkp pkp-lib within the XSL transformation component. The flaw exists in the _transformPHP function located in the classes/xslt/XSLTransformer.php file. This security defect allows remote attackers to exploit insecure XML parsing configurations during the processing of XSLT stylesheets or input documents.\nSuccessful exploitation of this vulnerability can lead to severe operational and security impacts, including unauthorized disclosure of confidential local files, server-side request forgery (SSRF), port scanning of internal networks, and potential denial of service conditions against the host infrastructure. The affected products include pkp-lib versions up to 3.3.0-22, 3.4.0-10, and 3.5.0-4.\nThe vulnerability presents significant risk implications as it can be triggered remotely without requiring pre-existing authentication or specialized privileges, provided the attacker can supply or influence the XML/XSL input processed by the vulnerable transformation function. Mitigation requires applying the official vendor patches by upgrading to the secure versions released by the maintainers.",
  "technicalDetails": "The root cause of this vulnerability lies in the improper handling and parsing of XML data within the _transformPHP function inside the classes/xslt/XSLTransformer.php file of pkp pkp-lib. Specifically, the underlying XML parser or XSL processor is configured to resolve external entity references within untrusted XML input without sufficient restrictions or by explicitly enabling external DTD (Document Type Definition) parsing.\nThe vulnerability affects pkp pkp-lib versions up to 3.3.0-22, 3.4.0-10, and 3.5.0-4. The attack vector is fully remote, requiring network exposure to the application endpoints that invoke the XSLTransformer component. No authentication or elevated privileges are required to initiate the attack, making it accessible to unauthenticated external threat actors.\nThe attack flow proceeds as follows: First, the attacker crafts a malicious XML payload or XSL stylesheet containing custom XML External Entity (XXE) definitions. These definitions point to internal system resources (such as /etc/passwd on Linux-based environments) or internal network services via protocols like file:// or http://. Second, the attacker transmits this crafted payload to the vulnerable web application endpoint where it is processed by the _transformPHP function in classes/xslt/XSLTransformer.php. Third, the insecurely configured XML parser evaluates the external entity during the transformation process, dereferences the URI specified in the entity definition, and retrieves the target resource. Finally, depending on the application's error handling and output rendering behavior, the contents of the retrieved file or the response from the internal service may be reflected back to the attacker in the HTTP response, or utilized to exfiltrate sensitive data out-of-band.\nPost-exploitation impact ranges widely depending on the network architecture and host permissions. If the web server process runs with elevated privileges or has broad read access to the underlying filesystem, sensitive configuration files, source code, and credentials can be exposed. Furthermore, if outbound network connections are permitted from the hosting environment, the vulnerability can be leveraged to pivot deeper into internal network segments behind firewalls via Server-Side Request Forgery."
}