CVE-2026-76572

Name of the Vulnerable Software and Affected Versions pkp pkp-lib versions prior to 3.3.0-23 pkp pkp-lib versions prior to 3.4.0-11 pkp pkp-lib versions prior to 3.5.0-5

Description A remote attack is possible through the manipulation of the transformPHP() function within the classes/xslt/XSLTransformer.php file. This issue leads to an XML External Entity (XXE) reference, which occurs when an application processes XML input containing a reference to an external entity.

Recommendations Update to version 3.3.0-23. Update to version 3.4.0-11. Update to version 3.5.0-5. As a temporary mitigation, restrict access to the transformPHP() function.