CVE-2012-1467: Pkp Open Journal Systems

Medium severity, CVSS 6.5. EPSS: 3% chance of exploitation in the next 30 days.

Multiple directory traversal vulnerabilities in the iBrowser plugin library, as used in Open Journal Systems before 2.3.7, allow remote authenticated users to (1) delete or (2) rename arbitrary files via a .. (dot dot) in the param parameter to lib/pkp/lib/tinymce/jscripts/tiny_mce/plugins/ibrowser/scripts/rfiles.php.

Affected products

• Pkp Open Journal Systems: up to and including 2.3.6

Published 2012-09-06. Last modified 2026-06-16.