CVE-2025-67893 | pkp pkp-lib up to 3.4.0-9/3.5.0-1 compileLess addLessVariables code injection

A vulnerability was found in pkp pkp-lib up to 3.4.0-9/3.5.0-1 and classified as critical. Impacted is the function PKPTemplateManager::compileLess. Such manipulation of the argument addLessVariables leads to code injection.

This vulnerability is uniquely identified as CVE-2025-67893. The attack can be launched remotely. No exploit exists.

It is suggested to upgrade the affected component.