CVE-2026-76572

Katalog CVE

CVSS 4.7 · Medium EPSS 0,45%

Kerentanan Externally Controlled Reference to a Resource in Another Sphere. Skor CVSS 3.1 4.7 (Medium) menurut vuldb.com.

Deskripsi (NVD)

A vulnerability was detected in pkp pkp-lib up to 3.3.0-22/3.4.0-10/3.5.0-4. The affected element is the function _transformPHP of the file classes/xslt/XSLTransformer.php. The manipulation results in xml external entity reference. The attack can be executed remotely. Upgrading to version 3.3.0-23, 3.4.0-11 and 3.5.0-5 is sufficient to fix this issue. The patch is identified as 78c699370ea43ae2784e1c4ace7c947d207f2b47. Upgrading the affected component is advised.

Rincian

Terbit di NVD

19 Agustus 2026

Terakhir diubah

20 Agustus 2026

Status NVD

Deferred

CVSS 3.1

4.7 (Medium), sumber vuldb.com
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-610: Externally Controlled Reference to a Resource in Another Sphere
CWE-611: Improper Restriction of XML External Entity Reference

EPSS (30 hari)

0,45% peluang dieksploitasi; lebih tinggi dari 37,6% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://github.com/pkp/pkp-lib/
• https://github.com/pkp/pkp-lib/commit/78c699370ea43ae2784e1c4ace7c947d207f2b47
• https://github.com/pkp/pkp-lib/issues/12977
• https://github.com/pkp/pkp-lib/releases/tag/3_5_0-5
• https://vuldb.com/cve/CVE-2026-76572
• https://vuldb.com/submit/878359
• https://vuldb.com/vuln/393037
• https://vuldb.com/vuln/393037/cti