CVE-2026-76572 - pkp pkp-lib XSLTransformer.php _transformPHP xml external entity reference

Back Back to CVE browser

MEDIUM

pkp pkp-lib XSLTransformer.php _transformPHP xml external entity reference

Published Aug 19, 2026

5.1

MEDIUM

CVSS 4.0

EPSS 0.45%

Description

A vulnerability was detected in pkp pkp-lib up to 3.3.0-22/3.4.0-10/3.5.0-4. The affected element is the function _transformPHP of the file classes/xslt/XSLTransformer.php. The manipulation results in xml external entity reference. The attack can be executed remotely. Upgrading to version 3.3.0-23, 3.4.0-11 and 3.5.0-5 is sufficient to fix this issue. The patch is identified as 78c699370ea43ae2784e1c4ace7c947d207f2b47. Upgrading the affected component is advised.

Affected products

Vendor Pkp Product Pkp-Lib Default
n/a
- Version
  3.3.0-22
  Status
  affected
  Constraints
  -
- Version
  3.4.0-10
  Status
  affected
  Constraints
  -
- Version
  3.5.0-4
  Status
  affected
  Constraints
  -
- Version
  3.3.0-23
  Status
  unaffected
  Constraints
  -
- Version
  3.4.0-11
  Status
  unaffected
  Constraints
  -
- Version
  3.5.0-5
  Status
  unaffected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Pkp

Pkp-Lib

n/a

Version	Status	Constraints
3.3.0-22	affected	-
3.4.0-10	affected	-
3.5.0-4	affected	-
3.3.0-23	unaffected	-
3.4.0-11	unaffected	-
3.5.0-5	unaffected	-

Remediation

No remediation recorded yet.

Weaknesses (2)

CWE-610

CWE-611

XXE

References (9)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-62724
Advisory
https://github.com/pkp/pkp-lib/
product
https://github.com/pkp/pkp-lib/commit/78c699370ea43ae2784e1c4ace7c947d207f2b47
patch
https://github.com/pkp/pkp-lib/issues/12977
issue-tracking
https://github.com/pkp/pkp-lib/releases/tag/3_5_0-5
patch
https://vuldb.com/cve/CVE-2026-76572
third-party-advisory
https://vuldb.com/submit/878359
third-party-advisory
https://vuldb.com/vuln/393037
vdb-entrytechnical-description
https://vuldb.com/vuln/393037/cti
signaturepermissions-required

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-62724		Advisory
https://github.com/pkp/pkp-lib/		product
https://github.com/pkp/pkp-lib/commit/78c699370ea43ae2784e1c4ace7c947d207f2b47		patch
https://github.com/pkp/pkp-lib/issues/12977		issue-tracking
https://github.com/pkp/pkp-lib/releases/tag/3_5_0-5		patch
https://vuldb.com/cve/CVE-2026-76572		third-party-advisory
https://vuldb.com/submit/878359		third-party-advisory
https://vuldb.com/vuln/393037		vdb-entrytechnical-description
https://vuldb.com/vuln/393037/cti		signaturepermissions-required