Path Traversal Tango: How Open Journal Systems Danced with Disaster! 🚨

Hot Take:

Imagine you’re a Journal Editor just minding your own business, sipping on a latte, and suddenly, you’re the main character in a cyber-thriller because the native XML plugin in Open Journal Systems has a path traversal vulnerability. Who knew editing could be so dangerous? Time to upgrade, or your web server might end up more scrambled than your breakfast eggs!

Key Points:

• Open Journal Systems (OJS) <= 3.5.0-1 has a vulnerability in the Native XML Plugin.
• The vulnerability allows path traversal, potentially leading to remote code execution (RCE).
• An attacker needs specific user privileges and knowledge of the server path to exploit this.
• Fixes are available in versions 3.3.0-22, 3.4.0-10, and 3.5.0-2.
• Discovered by Egidio Romano, the issue has been assigned CVE-2025-67890.

XML: The Trojan Horse of Code

Once upon a time, in a land of academic publishing, the Open Journal Systems’ Native XML Plugin decided to play a little game of path traversal. This trickster issue lurks in the shadows of the issue_galley -> issue_file -> file_name tags, waiting for an unsuspecting Journal Editor or Production Editor to walk by with their credentials. If the editor happens to have the right access, the XML file tag leaps out and writes or overwrites files on the server. The result? Potential execution of sneaky arbitrary PHP code while your latte cools down.

The Quest for Exploitation

To exploit this vulnerability, the villainous hacker needs to be more than just tech-savvy—they need a treasure map: the web server path where the OJS is installed. It’s like needing the precise coordinates to Captain Blackbeard’s hidden loot. If they can guess or uncover this path, and if they have access to the “Import/Export” plugin, they’re halfway to becoming the new pirate king (or queen) of your server. But fear not, for there is hope on the horizon in the form of an upgrade.

Patch It Like It’s Hot

In the cybersecurity world, it’s all about the upgrades. To thwart the path traversal antics, you simply need to patch to versions 3.3.0-22, 3.4.0-10, or the shiny and new 3.5.0-2. It’s like leveling up in a video game, except instead of a new weapon, you get a secure server. The vendor was quick to respond, and by December 2025, the problem was locked up tighter than Fort Knox, all thanks to the diligent work of Egidio Romano. So, if your OJS is still running on an older version, it’s time to upgrade before someone turns your server into their personal playground.

The Timeline of Heroics

In the grand saga of cybersecurity, the vulnerability journey started on October 21, 2025, when our hero discovered the bug and notified the vendor. Fast forward three days, and the vendor waved their magic wand and fixed the issue, even opening a public GitHub issue for all to see. By December, a CVE identifier was assigned, marking the villainous bug for all eternity. Now, with the advisory published just before Christmas, it’s a reminder that even during the holiday season, cybersecurity never takes a break.

Vulnerabilities: The Gift That Keeps on Giving

Every year brings a new batch of vulnerabilities, each with its own backstory and cast of characters. This particular exploit, CVE-2025-67890, is a story of prompt discovery, swift action, and the power of the upgrade. Thanks to the eagle-eyed vigilance of the cybersecurity community, what could have been a major issue was quickly resolved. So, while the threat of path traversal may have given some Journal Editors a fright, it’s all in a day’s work in the world of cybersecurity. Just remember: when in doubt, patch it out!