Pkp Lib
Monthly
XML External Entity (XXE) injection in the XSLTransformer component of pkp-lib - the shared PHP library underlying Open Journal Systems, Open Monograph Press, and Open Preprint Systems - allows high-privileged authenticated users to force server-side external entity resolution during XSLT processing, enabling local file disclosure and potential server-side request forgery. Affected branches span all three actively maintained release lines (3.3.x, 3.4.x, 3.5.x) with vendor-released patches confirmed for each. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog.
XML External Entity (XXE) injection in the XSLTransformer component of pkp-lib - the shared PHP library underlying Open Journal Systems, Open Monograph Press, and Open Preprint Systems - allows high-privileged authenticated users to force server-side external entity resolution during XSLT processing, enabling local file disclosure and potential server-side request forgery. Affected branches span all three actively maintained release lines (3.3.x, 3.4.x, 3.5.x) with vendor-released patches confirmed for each. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog.