PKP-WAL 3.4.0-3 Remote Code Execution

--------------------------------------------------------------------------------- PKP-WAL getDeployment; 103. 104. $context = $deployment-getContext; 105. 106. $locale = $node-getAttribute'locale'; 107. if empty$locale 108. $locale = $context-getPrimaryLocale; 109. 110. 111. $coverImagelocale = ;...

CVE-2023-47271

PKP-WAL (pkp-lib) before 3.3.0-16, used in OJS and related products, fails to verify that a file named in an XML document (Native Import/Export plugin) is an image before using it as an issue cover image. The issue stems from PKPNativeFilterHelper::parsePublicationCover() in the NativeImportExpor...