{“lastseen”:”2025-12-23T17:14:43″,”description”:”Open Journal Systems versions 3.5.0-1 and below suffer from a path traversal vulnerability in NativeXmlIssueGalleyFilter.php…”,”published”:”2025-12-23T00:00:00″,”modified”:”2025-12-23T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 Open Journal Systems 3.5.0-1 Path Traversal”,”source”:””,”references”:””,”id”:”PACKETSTORM:213266″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[“CVE-2025-67890″],”sourceData”:”———————————————————————————————\\n Open Journal Systems \\u003c= 3.5.0-1 (NativeXmlIssueGalleyFilter.php) Path\\n Traversal Vulnerability\\n ———————————————————————————————\\n \\n \\n [-] Software Links:\\n \\n https:\/\/pkp.sfu.ca\/software\/ojs\/\\n https:\/\/github.com\/pkp\/ojs\\n \\n \\n [-] Affected Versions:\\n \\n Version 3.3.0-21 and prior versions.\\n Version 3.4.0-9 and prior versions.\\n Version 3.5.0-1 and prior versions.\\n \\n \\n [-] Vulnerability Description:\\n \\n The vulnerability exists because user input passed to the \\”Native XML\\n Plugin\\” through the issue -\\u003e issue_galleys -\\u003e issue_galley -\\u003e\\n issue_file -\\u003e file_name tag of the imported XML file is not properly\\n sanitized before being used to set the \\”server-side file name\\”, which\\n is later used as the final part of a variable which is used at in a\\n call to the writeFile() method without proper validation. This can be\\n exploited to write\/overwrite arbitrary files on the web server via\\n Path Traversal sequences, potentially leading to, e.g., execution of\\n arbitrary PHP code (RCE).\\n \\n Successful exploitation of this vulnerability requires an account with\\n permissions to access the \\”Import\/Export\\” plugin (\\”Native XML\\n Plugin\\”), such as a \\”Journal Editor\\” or \\”Production Editor\\” user\\n account. Furthermore, in order to perform the following Remote Code\\n Execution (RCE) attack, the attacker should know or guess\/disclose the\\n webserver path in which OJS is located (e.g.\\n \/var\/www\/html\/ojs-3.5.0-1).\\n \\n \\n [-] Solution:\\n \\n Upgrade to versions 3.3.0-22, 3.4.0-10, 3.5.0-2, or later.\\n \\n \\n [-] Disclosure Timeline:\\n \\n [21\/10\/2025] – Vendor notified\\n [24\/10\/2025] – Vendor fixed the issue and opened a public GitHub\\n issue: https:\/\/github.com\/pkp\/pkp-lib\/issues\/11973\\n [12\/11\/2025] – CVE identifier requested\\n [20\/11\/2025] – Version 3.3.0-22 released\\n [22\/11\/2025] – Version 3.4.0-10 released\\n [12\/12\/2025] – CVE identifier assigned\\n [29\/11\/2025] – Version 3.5.0-2 released\\n [23\/12\/2025] – Publication of this advisory\\n \\n \\n [-] CVE Reference:\\n \\n The Common Vulnerabilities and Exposures program (cve.org) has\\n assigned the name CVE-2025-67890 to this vulnerability.\\n \\n \\n [-] Credits:\\n \\n Vulnerability discovered by Egidio Romano.\\n \\n \\n [-] Original Advisory:\\n \\n http:\/\/karmainsecurity.com\/KIS-2025-11″,”sourceHref”:”https:\/\/packetstorm.news\/download\/213266″,”cvss”:{“score”:0,”severity”:”NONE”,”vector”:”NONE”,”version”:”NONE”},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/packetstorm.news\/files\/id\/213266\/”,”category_name”:”Exploit”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2025-12-23T17:14:43″,”description”:”Open Journal Systems versions 3.5.0-1 and below suffer from a path traversal vulnerability in NativeXmlIssueGalleyFilter.php…”,”published”:”2025-12-23T00:00:00″,”modified”:”2025-12-23T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 Open Journal Systems 3.5.0-1 Path Traversal”,”source”:””,”references”:””,”id”:”PACKETSTORM:213266″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[“CVE-2025-67890″],”sourceData”:”———————————————————————————————\\n Open Journal Systems \\u003c=…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[6,8,12,13,33,53,7,11,5],"class_list":["post-32546","post","type-post","status-publish","format-standard","hentry","category-category_exploit","tag-cve","tag-cvss","tag-exploit","tag-news","tag-none","tag-packetstorm","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n