CVE-2023-47271

Name of the Vulnerable Software and Affected Versions PKP-WAL versions prior to 3.3.0-16 PKP-WAL versions prior to 3.4.0-3

Description The issue arises from the failure to verify that a file named in an XML document, used for the native import/export plugin, is an image file before attempting to use it for an issue cover image. This can lead to remote code execution.

Recommendations For versions prior to 3.3.0-16, update to version 3.3.0-16 or later. For versions prior to 3.4.0-3, update to version 3.4.0-3 or later. As a temporary workaround, consider disabling the native import/export plugin until a patch is available. Restrict access to the XML import functionality to minimize the risk of exploitation.