CVE-2026-76572

Received Received - Intake

XML External Entity Injection in pkp-lib

Publication date: 2026-08-19

Last updated on: 2026-08-19

Assigner: VulDB

Description

A vulnerability was detected in pkp pkp-lib up to 3.3.0-22/3.4.0-10/3.5.0-4. The affected element is the function _transformPHP of the file classes/xslt/XSLTransformer.php. The manipulation results in xml external entity reference. The attack can be executed remotely. Upgrading to version 3.3.0-23, 3.4.0-11 and 3.5.0-5 is sufficient to fix this issue. The patch is identified as 78c699370ea43ae2784e1c4ace7c947d207f2b47. Upgrading the affected component is advised.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-19

Last Modified

2026-08-19

Generated

2026-08-20

AI Q&A

2026-08-20

EPSS Evaluated

N/A

NVD

CVE-2026-76572

EUVD

EUVD-2026-62724

Affected Vendors & Products

Vendor	Product	Version / Range
pkp	pkp-lib	to 3.5.0-4 (inc)
public_knowledge_project	pkp-lib	to 3.3.0\|end_excluding=3.4.0\|end_excluding=3.5.0 (exc)
public_knowledge_project	pkp-lib	3.3.0-23
public_knowledge_project	pkp-lib	3.4.0-11
public_knowledge_project	pkp-lib	3.5.0-5

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-611	The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.
CWE-610	The product uses an externally controlled name or reference that resolves to a resource that is outside of the intended control sphere.

Attack-Flow Graph

Executive Summary

This vulnerability is an XML External Entity (XXE) attack in the pkp-lib library up to versions 3.3.0-22, 3.4.0-10, and 3.5.0-4. The issue occurs in the _transformPHP function of classes/xslt/XSLTransformer.php, where XML files can be manipulated to reference external entities, potentially exposing sensitive data or causing denial of service.

Detection Guidance

To detect this vulnerability, check the version of pkp-lib in your system. Compare it against versions 3.3.0-22, 3.4.0-10, and 3.5.0-4. If your version matches or is older, the system is vulnerable. Inspect the XSLTransformer.php file for the _transformPHP function and verify if external XML entity loading is enabled.

Impact Analysis

An attacker could exploit this to read sensitive files, perform server-side request forgery, or cause denial of service by processing malicious XML inputs. Systems using affected pkp-lib versions in applications like OJS, OCS, OMP, OPS, or OHS are at risk if they process user-controlled XML files.

Compliance Impact

This vulnerability could lead to unauthorized data exposure, violating GDPR's data protection principles or HIPAA's security requirements for protected health information. Organizations must address it to maintain compliance with data confidentiality and integrity mandates.

Mitigation Strategies

Upgrade pkp-lib to version 3.3.0-23, 3.4.0-11, or 3.5.0-5 or later. Apply the patch commit 78c699370ea43ae2784e1c4ace7c947d207f2b47 which disables external XML entity loading in XSLTransformer.php.

Hi! I’m here to help you understand CVE-2026-76572. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70