{“lastseen”:”2025-12-23T17:14:20″,”description”:”PKP-WAL versions 3.5.0-3 and below suffer from a LESS X-Forwarded-Host related code injection vulnerability…”,”published”:”2025-12-23T00:00:00″,”modified”:”2025-12-23T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 PKP-WAL 3.5.0-3 X-Forwarded-Host LESS Code Injection”,”source”:””,”references”:””,”id”:”PACKETSTORM:213268″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[“CVE-2025-67891″],”sourceData”:”———————————————————————–\\n PKP-WAL \\u003c= 3.5.0-3 (X-Forwarded-Host) LESS Code Injection Vulnerability\\n ———————————————————————–\\n \\n \\n [-] Software Links:\\n \\n https:\/\/pkp.sfu.ca\\n https:\/\/github.com\/pkp\/pkp-lib\\n \\n \\n [-] Affected Versions:\\n \\n PKP Web Application Library (aka PKP-WAL or pkp-lib) version 3.4.0-10\\n and prior versions, and version 3.5.0-3 and prior versions, as used in\\n Open Journal Systems (OJS), Open Monograph Press (OMP), and Open\\n Preprint Systems (OPS).\\n \\n \\n [-] Vulnerability Description:\\n \\n The vulnerability exists within the PKPTemplateManager::compileLess()\\n method, which will call the Less_Parser::parse() method passing to it\\n the \\”baseUrl\\” variable. Such a variable, which is constructed from a\\n call to the $request-\\u003egetBaseUrl() method, can be manipulated by\\n unauthenticated attackers through the X-Forwarded-Host HTTP header,\\n and this can be exploited to perform LESS Code Injection attacks,\\n subsequently leading to SSRF or Local File Read attacks.\\n \\n Successful exploitation of this vulnerability requires the\\n allowed_hosts setting to be set to an empty string within the\\n config.inc.php script.\\n \\n \\n [-] Solution:\\n \\n No official solution is currently available.\\n \\n \\n [-] Disclosure Timeline:\\n \\n [21\/10\/2025] – Vendor notified\\n \\n [24\/10\/2025] – Vendor replied the following GitHub issue already\\n solves the issue: https:\/\/github.com\/pkp\/pkp-lib\/issues\/7649\\n \\n [25\/10\/2025] – Response sent to the vendor, stating this should be\\n treated as a new, different issue\\n \\n [12\/11\/2025] – CVE identifier requested\\n \\n [12\/12\/2025] – CVE identifier assigned\\n \\n [23\/12\/2025] – Publication of this advisory\\n \\n \\n [-] CVE Reference:\\n \\n The Common Vulnerabilities and Exposures program (cve.org) has\\n assigned the name CVE-2025-67891 to this vulnerability.\\n \\n \\n [-] Credits:\\n \\n Vulnerability discovered by Egidio Romano.\\n \\n \\n [-] Original Advisory:\\n \\n http:\/\/karmainsecurity.com\/KIS-2025-13″,”sourceHref”:”https:\/\/packetstorm.news\/download\/213268″,”cvss”:{“score”:0,”severity”:”NONE”,”vector”:”NONE”,”version”:”NONE”},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/packetstorm.news\/files\/id\/213268\/”,”category_name”:”Exploit”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2025-12-23T17:14:20″,”description”:”PKP-WAL versions 3.5.0-3 and below suffer from a LESS X-Forwarded-Host related code injection vulnerability…”,”published”:”2025-12-23T00:00:00″,”modified”:”2025-12-23T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 PKP-WAL 3.5.0-3 X-Forwarded-Host LESS Code Injection”,”source”:””,”references”:””,”id”:”PACKETSTORM:213268″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[“CVE-2025-67891″],”sourceData”:”———————————————————————–\\n PKP-WAL \\u003c= 3.5.0-3 (X-Forwarded-Host) LESS…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[6,8,12,13,33,53,7,11,5],"class_list":["post-32548","post","type-post","status-publish","format-standard","hentry","category-category_exploit","tag-cve","tag-cvss","tag-exploit","tag-news","tag-none","tag-packetstorm","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n