Read the docs
TI-2023-25585 Aliases CVE-2023-47271GHSA-8f7j-g5xp-rc4p

PKP-WAL (aka PKP Web Application Library or pkp-lib) before 3.3.0-16, as used in Open…

Priority LOW 31Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · Low · None
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA.

Summary

PKP-WAL (aka PKP Web Application Library or pkp-lib) before 3.3.0-16, as used in Open Journal Systems (OJS) and other products, does not verify that the file named in an XML document (used for the native import/export plugin) is an image file, before trying to use it for an issue cover image.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0075 55th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:sfu:pkp_web_application_library:*:*:*:*:*:*:*:*before 3.3.0-16VulnerableSfu
  • cpe:2.3:a:sfu:pkp_web_application_library:*:*:*:*:*:*:*:* Versions before 3.3.0-16 Vulnerable ·Sfu

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-47271
  2. 2026-10-03 Alias added: GHSA-8f7j-g5xp-rc4p
  3. 2026-11-07 EPSS moved to the 50th–90th percentile

References

Patch 1

Other 2

  • TI-2023-05425 Cross-Site Request Forgery (CSRF) in pkp/pkp-lib CVSS 3.1HIGH 8.8
  • TI-2023-05436 Cross-site Scripting (XSS) - Stored in pkp/pkp-lib CVSS 3.1MEDIUM 5.4
  • TI-2023-05435 Cross-site Scripting (XSS) - Stored in pkp/pkp-lib CVSS 3.1MEDIUM 5.4
  • TI-2023-05428 Cross-site Scripting (XSS) - Stored in pkp/pkp-lib CVSS 3.1MEDIUM 5.4
  • TI-2023-05427 Cross-site Scripting (XSS) - DOM in pkp/pkp-lib CVSS 3.1MEDIUM 5.4
  • TI-2023-05424 Cross-site Scripting (XSS) - Stored in pkp/pkp-lib CVSS 3.1MEDIUM 5.4
See all 11 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences