📄 PKP-WAL 3.5.0-1 baseColour LESS Code Injection_PACKETSTORM:213267

Description

PKP-WAL versions 3.5.0-1 and below suffer from a LESS baseColour related code injection vulnerability...

Basic Information

ID PACKETSTORM:213267

Published Dec 23, 2025 at 00:00

Affected Product

Affected Versions -----------------------------------------------------------------
PKP-WAL <= 3.5.0-1 (baseColour) LESS Code Injection Vulnerability
-----------------------------------------------------------------

[-] Software Links:

https://pkp.sfu.ca
https://github.com/pkp/pkp-lib

[-] Affected Versions:

PKP Web Application Library (aka PKP-WAL or pkp-lib) version 3.4.0-9
and prior versions, and version 3.5.0-1 and prior versions, as used in
Open Journal Systems (OJS), Open Monograph Press (OMP), and Open
Preprint Systems (OPS).

[-] Vulnerability Description:

The vulnerability exists within the PKPTemplateManager::compileLess()
method. This will call the Less_Parser::parse() method by using the
"addLessVariables", which can be manipulated when updating "Theme
Settings". Specifically, user input passed through the "baseColour"
parameter to the .../api/v1/contexts/1/theme API endpoint is not
properly sanitized before being added to the "addLessVariables", and
this can be exploited to perform LESS Code Injection attacks,
subsequently leading to SSRF or Local File Read attacks.

Successful exploitation of this vulnerability requires an account with
permissions to access the .../api/v1/institutions API endpoint, such
as a "Journal Editor" or "Production Editor" user account on OJS.

[-] Solution:

Upgrade to versions 3.4.0-10, 3.5.0-2, or later.

[-] Disclosure Timeline:

[21/10/2025] - Vendor notified
[24/10/2025] - Vendor fixed the issue and opened a public GitHub
issue: https://github.com/pkp/pkp-lib/issues/11974
[12/11/2025] - CVE identifier requested
[20/11/2025] - Version 3.3.0-22 released
[22/11/2025] - Version 3.4.0-10 released
[12/12/2025] - CVE identifier assigned
[29/11/2025] - Version 3.5.0-2 released
[23/12/2025] - Publication of this advisory

[-] CVE Reference:

The Common Vulnerabilities and Exposures program (cve.org) has
assigned the name CVE-2025-67893 to this vulnerability.

[-] Credits:

Vulnerability discovered by Egidio Romano.

[-] Original Advisory:

http://karmainsecurity.com/KIS-2025-12

{
    "lastseen": "2025-12-23T17:14:31",
    "description": "PKP-WAL versions 3.5.0-1 and below suffer from a LESS baseColour related code injection vulnerability...",
    "published": "2025-12-23T00:00:00",
    "modified": "2025-12-23T00:00:00",
    "type": "packetstorm",
    "title": "\ud83d\udcc4 PKP-WAL 3.5.0-1 baseColour LESS Code Injection",
    "source": "",
    "references": "",
    "id": "PACKETSTORM:213267",
    "bulletinFamily": "exploit",
    "cwe": null,
    "cvelist": [
        "CVE-2025-67893"
    ],
    "sourceData": "-----------------------------------------------------------------\n    PKP-WAL <= 3.5.0-1 (baseColour) LESS Code Injection Vulnerability\n    -----------------------------------------------------------------\n    \n    \n    [-] Software Links:\n    \n    https://pkp.sfu.ca\n    https://github.com/pkp/pkp-lib\n    \n    \n    [-] Affected Versions:\n    \n    PKP Web Application Library (aka PKP-WAL or pkp-lib) version 3.4.0-9\n    and prior versions, and version 3.5.0-1 and prior versions, as used in\n    Open Journal Systems (OJS), Open Monograph Press (OMP), and Open\n    Preprint Systems (OPS).\n    \n    \n    [-] Vulnerability Description:\n    \n    The vulnerability exists within the PKPTemplateManager::compileLess()\n    method. This will call the Less_Parser::parse() method by using the\n    \"addLessVariables\", which can be manipulated when updating \"Theme\n    Settings\". Specifically, user input passed through the \"baseColour\"\n    parameter to the .../api/v1/contexts/1/theme API endpoint is not\n    properly sanitized before being added to the \"addLessVariables\", and\n    this can be exploited to perform LESS Code Injection attacks,\n    subsequently leading to SSRF or Local File Read attacks.\n    \n    Successful exploitation of this vulnerability requires an account with\n    permissions to access the .../api/v1/institutions API endpoint, such\n    as a \"Journal Editor\" or \"Production Editor\" user account on OJS.\n    \n    \n    [-] Solution:\n    \n    Upgrade to versions 3.4.0-10, 3.5.0-2, or later.\n    \n    \n    [-] Disclosure Timeline:\n    \n    [21/10/2025] - Vendor notified\n    [24/10/2025] - Vendor fixed the issue and opened a public GitHub\n    issue: https://github.com/pkp/pkp-lib/issues/11974\n    [12/11/2025] - CVE identifier requested\n    [20/11/2025] - Version 3.3.0-22 released\n    [22/11/2025] - Version 3.4.0-10 released\n    [12/12/2025] - CVE identifier assigned\n    [29/11/2025] - Version 3.5.0-2 released\n    [23/12/2025] - Publication of this advisory\n    \n    \n    [-] CVE Reference:\n    \n    The Common Vulnerabilities and Exposures program (cve.org) has\n    assigned the name CVE-2025-67893 to this vulnerability.\n    \n    \n    [-] Credits:\n    \n    Vulnerability discovered by Egidio Romano.\n    \n    \n    [-] Original Advisory:\n    \n    http://karmainsecurity.com/KIS-2025-12",
    "sourceHref": "https://packetstorm.news/download/213267",
    "cvss": {
        "score": 0,
        "severity": "NONE",
        "vector": "NONE",
        "version": "NONE"
    },
    "cvss2": [],
    "cvss3": {
        "version": "",
        "vectorString": "",
        "baseScore": 0,
        "baseSeverity": "",
        "attackVector": "",
        "attackComplexity": "",
        "privilegesRequired": "",
        "userInteraction": "",
        "scope": "",
        "confidentialityImpact": "",
        "integrityImpact": "",
        "availabilityImpact": "",
        "cvssV3": {
            "version": "",
            "vectorString": "",
            "baseScore": 0,
            "baseSeverity": "",
            "attackVector": "",
            "attackComplexity": "",
            "privilegesRequired": "",
            "userInteraction": "",
            "scope": "",
            "confidentialityImpact": "",
            "integrityImpact": "",
            "availabilityImpact": ""
        }
    },
    "href": "https://packetstorm.news/files/id/213267/",
    "category_name": "Exploit",
    "post_link": "",
    "product": "",
    "version": "",
    "vendor": "",
    "ai_description": "",
    "ai_severity": "",
    "ai_vendor": "",
    "ai_product": "",
    "ai_version": "",
    "ai_score": 0
}

Description

Basic Information

Affected Product

💭 Join the Security Discussion ❌ Cancel Reply