Read the docs
TI-2026-53513 Aliases CVE-2026-76572GHSA-8j8f-r97j-fp5x

pkp pkp-lib XSLTransformer.php _transformPHP xml external entity reference

Priority LOW 24CWE-610Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
Low · Low · Low
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

A vulnerability was detected in pkp pkp-lib up to 3.3.0-22/3.4.0-10/3.5.0-4. The affected element is the function _transformPHP of the file classes/xslt/XSLTransformer.php. The manipulation results in xml external entity reference. The attack can be executed remotely. Upgrading to version 3.3.0-23, 3.4.0-11 and 3.5.0-5 is sufficient to fix this issue. The patch is identified as 78c699370ea43ae2784e1c4ace7c947d207f2b47. Upgrading the affected component is advised.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00454 39th percentileScored 2026-11-07
Fix Fixed pkp-lib (pkp): 3.3.0-23, 3.4.0-11, 3.5.0-5

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
pkppkp-lib3.3.0-22; 3.4.0-10; 3.5.0-43.3.0-23, 3.4.0-11, 3.5.0-5Patch availableCNA
  • pkp-lib Vendorpkp Affected 3.3.0-22; 3.4.0-10; 3.5.0-4 Fixed in 3.3.0-23, 3.4.0-11, 3.5.0-5 Patch available CNA

CPE names CNA · 1

CPEVersionsRoleVendor
cpe:2.3:a:pkp:pkp-lib:*:*:*:*:*:*:*:*——pkp
  • cpe:2.3:a:pkp:pkp-lib:*:*:*:*:*:*:*:* Versions — — ·pkp

Remediation

  • Fix · CNA pkp-lib (pkp) Fixed in 3.3.0-23, 3.4.0-11, 3.5.0-5

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-76572
  2. 2026-10-03 Alias added: GHSA-8j8f-r97j-fp5x

References

Patch 2

Other 2

  • TI-2023-05431 Cross-Site Request Forgery (CSRF) in pkp/pkp-lib CVSS 3.1HIGH 8.8
  • TI-2023-05430 Cross-Site Request Forgery (CSRF) in pkp/pkp-lib CVSS 3.1HIGH 8.8
  • TI-2023-05429 Cross-Site Request Forgery (CSRF) in pkp/customLocale CVSS 3.1HIGH 8.8
  • TI-2023-05425 Cross-Site Request Forgery (CSRF) in pkp/pkp-lib CVSS 3.1HIGH 8.8
  • TI-2023-05178 Cross-Site Request Forgery (CSRF) in pkp/ojs CVSS 3.1HIGH 8.8
  • TI-2023-04327 Use of Predictable Algorithm in Random Number Generator in pkp/pkp-lib CVSS 3.1HIGH 8.1
See all 24 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences