pkp-lib EUVD-2026-62724

Exploitation requires a valid high-privilege authenticated session (CVSS PR:H), specifically a journal manager or site administrator account within the PKP platform. The vulnerable code path is reached when the _transformPHP or _transformExternal function in classes/xslt/XSLTransformer.php processes attacker-supplied XML or XSL content - this occurs via administrative workflows such as XML metadata import, XSLT-based transformation operations, or similar features that accept XML input. Limiting factors are: (1) the attacker must hold an administrator or journal manager role; (2) the XSLT transformation feature must be invoked, which is not a default user-facing action; (3) standard contributor, reviewer, or reader accounts cannot reach this code path. There is no pathway to unauthenticated exploitation per the CVSS PR:H designation.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N) scores 5.1, with partial and symmetric impacts across confidentiality, integrity, and availability (VC:L/VI:L/VA:L) and no subsequent-system impact (SC:N/SI:N/SA:N). The PR:H requirement is the dominant risk-reduction factor: exploitation is gated behind a high-privilege authenticated session, ruling out opportunistic unauthenticated scanning. No EPSS score was provided in the source data, and the vulnerability is absent from CISA KEV, which together suggest it has not attracted automated or mass exploitation at time of analysis. Even a mid-sized municipal IT team in swidnica running a regional OJS instance should be able to address this through a standard patch cycle rather than emergency response, given that the attack requires administrator or journal manager credentials. The disconnect between the network-accessible attack vector and the high-privilege prerequisite means raw CVSS numerics likely overstate risk for most deployments; defenders should weight the PR:H gating heavily when prioritising remediation.

A journal manager or site administrator with a valid high-privilege session uploads or supplies a crafted XML document containing a malicious external entity declaration - for example, referencing file:///etc/passwd or an internal network endpoint - through an administrative metadata import or XSLT processing interface. The _transformPHP function passes this document to DOMDocument with entity resolution enabled, causing libxml2 to fetch and inline the referenced resource, which surfaces in the XSLT transformation output returned to the attacker. No public proof-of-concept exploit code is known at time of analysis.