CVE-2026-76572 in pkp-lib
Summary
by MITRE • 08/20/2026
A vulnerability was detected in pkp pkp-lib up to 3.3.0-22/3.4.0-10/3.5.0-4. The affected element is the function _transformPHP of the file classes/xslt/XSLTransformer.php. The manipulation results in xml external entity reference. The attack can be executed remotely. Upgrading to version 3.3.0-23, 3.4.0-11 and 3.5.0-5 is sufficient to fix this issue. The patch is identified as 78c699370ea43ae2784e1c4ace7c947d207f2b47. Upgrading the affected component is advised.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/20/2026
The Open Journal Systems platform, specifically within its underlying pkp-lib library versions up to 3.3.0-22, 3.4.0-10, and 3.5.0-4, contains a critical security flaw in the XML processing logic. This vulnerability resides in the _transformPHP function located in the classes/xslt/XSLTransformer.php file. The core issue is an improper neutralization of special elements used in external entity references, commonly known as XML External Entity injection or XXE. In this context, the application fails to adequately restrict or validate the input data before it is processed by the PHP XML parser. This lack of sanitization allows an attacker to inject maliciously crafted XML content that includes definitions for external entities pointing to arbitrary local or remote resources.
From a technical perspective, the flaw stems from the configuration and usage of the libxml library in PHP without appropriate security constraints enabled. By default, older configurations may allow the resolution of external entity references during parsing operations such as XSLT transformations. When an attacker supplies controlled input that includes DOCTYPE declarations with ENTITY definitions, they can force the server to fetch data from internal network locations or exfiltrate sensitive files by referencing them through these entities. This capability transforms a standard XML processing function into a vector for unauthorized information disclosure and potentially remote code execution if combined with other vulnerabilities in the stack.
The operational impact of this vulnerability is significant due to its potential for remote exploitation. An attacker does not necessarily need authentication to attempt an exploit, depending on which endpoints expose the affected XSLT functionality. Successful exploitation can lead to severe confidentiality breaches where sensitive server files such as configuration scripts containing database credentials or internal network topology details are read and returned in the application response. Furthermore, if the underlying system permits it, this could facilitate denial of service conditions through billion laughs attacks or other entity expansion techniques that consume excessive memory and CPU resources on the target server.
This vulnerability aligns with CWE-611, which describes Improper Restriction of XML External Entity Reference. It also maps to MITRE ATT&CK technique T1059.007, specifically Command Shell via XML Injection or more broadly under data exfiltration techniques that leverage application logic flaws. The ability to read arbitrary files from the server filesystem is a primary concern here, as it can serve as an initial foothold for further lateral movement within the organization's infrastructure.
To mitigate this risk, immediate action is required by upgrading the pkp-lib component to version 3.3.0-23, 3.4.0-11, or 3.5.0-5 and later. These updated versions include patches that enforce stricter XML parsing policies, likely disabling external entity resolution by default or implementing robust input validation before passing data to the XSLT processor. Administrators should verify their current version using standard package management tools and apply the update promptly. Additionally, as a defense-in-depth measure, organizations should ensure that web application firewalls are configured to detect and block common XXE patterns in XML payloads, although this is not a substitute for patching the underlying software defect identified by commit 78c699370ea43ae2784e1c4ace7c947d207f2b47.