egix@karmainsecurity ~ $

PKP-WAL <= 3.5.0-1 (baseColour) LESS Code Injection Vulnerability

• Software Links:

https://pkp.sfu.ca

https://github.com/pkp/pkp-lib

• Affected Versions:

PKP Web Application Library (aka PKP-WAL or pkp-lib) version 3.4.0-9 and prior versions, and version 3.5.0-1 and prior versions, as used in Open Journal Systems (OJS), Open Monograph Press (OMP), and Open Preprint Systems (OPS).

• Vulnerability Description:

The vulnerability exists within the PKPTemplateManager::compileLess() method. This will call the Less_Parser::parse() method by using the “addLessVariables”, which can be manipulated when updating “Theme Settings”. Specifically, user input passed through the “baseColour” parameter to the .../api/v1/contexts/1/theme API endpoint is not properly sanitized before being added to the “addLessVariables”, and this can be exploited to perform LESS Code Injection attacks, subsequently leading to SSRF or Local File Read attacks.

Successful exploitation of this vulnerability requires an account with permissions to access the .../api/v1/institutions API endpoint, such as a “Journal Editor” or “Production Editor” user account on OJS.

• Proof of Concept:

  1. Login with an account with permissions to access the “Theme Settings”
  2. In the Dashboard, click on Settings -> Website
  3. Under the “Appearance” tab, keep selected the “Theme” sub-tab and click on the “Save” button
  4. Use a proxy tool such as Burp Suite to replicate the POST HTTP request sent to .../api/v1/contexts/1/theme
  5. Modify the “baseColour” parameter value in this way: 1;@import+(inline)+'/etc/passwd'
  6. Forward the request and notice how the “baseColour” parameter will be successfully updated
  7. Now, in order to trigger the LESS Code Injection, simply browse to the following URL: http://[host]/[ojs]/index.php/[journal]/$$$call$$$/page/page/css?name=stylesheet
  8. In this example, it was performed a Local File Read attack, disclosing the content of the /etc/passwd file on the server - however, also SSRF attacks are possible, by using a payload like this: 1;import+(inline)+'http://internalhost'

• Solution:

Upgrade to versions 3.4.0-10, 3.5.0-2, or later.

• Disclosure Timeline:

[21/10/2025] – Vendor notified

[24/10/2025] – Vendor fixed the issue and opened a public GitHub issue: https://github.com/pkp/pkp-lib/issues/11974

[12/11/2025] – CVE identifier requested

[20/11/2025] – Version 3.3.0-22 released

[22/11/2025] – Version 3.4.0-10 released

[12/12/2025] – CVE identifier assigned

[29/11/2025] – Version 3.5.0-2 released

[23/12/2025] – Publication of this advisory

• CVE Reference:

The Common Vulnerabilities and Exposures program (cve.org) has assigned the name CVE-2025-67893 to this vulnerability.

• Credits:

Vulnerability discovered by Egidio Romano.