The vulnerability resides in the _transformPHP function of pkp-lib’s XSLTransformer.php. It allows an attacker to craft XML input that causes the server’s XML processor to resolve an external entity reference. This flaw can expose sensitive data such as local files or database credentials, or trigger a denial of service by exhausting system resources. The weakness is classified under CWE-610 and CWE-611, indicating improper handling of external entity input during XML transformation.

Affected systems are installations of pkp-lib from the pkp vendor. Versions up to 3.3.0-22, 3.4.0-10, and 3.5.0-4 contain the flaw. Any environment running these releases or earlier should consider them vulnerable. The remediation is to upgrade to at least 3.3.0-23, 3.4.0-11, or 3.5.0-5, which incorporate the hotfix identified by commit 78c699370ea43ae2784e1c4ace7c947d207f2b47.

The CVSS score of 5.1 indicates moderate severity. EPSS information is not available, so the likelihood of exploitation cannot be quantified, but the vulnerability is exploitable remotely as the XML payload can be supplied over the network. It is not listed in the CISA KEV catalog, suggesting no known widespread exploitation at the time of this analysis. The common attack path would involve sending a malicious XML document to the XSL transformation endpoint, prompting the XML parser to fetch an external entity. If the parser is left configured to allow external references, the server may disclose internal data or crash.