Describe the issue or problem Similar to what was reported in Security Issue: Pdf viewer with strange suffix redirecting to multiple sites , we’ve seen a massive spike in Google Search Console traffic that hijacks the /plugins/generic/pdfJsViewer/pdf.js/web/viewer.html URL, logs a person out of OJS,…

Side note: even on journals where pdfJsViewer is not active, the /plugins/generic/pdfJsViewer/pdf.js/web/viewer.html URL still exists and is accessible. It looks like it defaults to displaying the compressed.tracemonkey-pldi-09.pdf file that’s included in the plugin directory.

Hi @mkmiec , This is the same issue as you linked above; the solution is to upgrade to the newest 3.4.0-x release (or 3.5.0-x if you’re ready for that). OJS 3.4.0-8 was released in 2024 and there have been numerous fixes and improvements since then; it’s important to keep up to date. Regards, Ale…

Thanks, @asmecher . Can you tell me exactly which version had the fix implemented? It’s not at all clear if there are release notes associated with the smaller point version releases. We may be able to update to a more recent version of 3.4, though our technical people may have worked out a network…

Hi @mkmiec , The fix is linked from the other thread: [image] Security Issue: Pdf viewer with strange suffix redirecting to multiple sites Software Support Hi @aabahishti , See #11242 , which has already been fixed in more recent releases of OJS. OJS 3.3.0-8 is…

[image] asmecher: The viewer.html file is just an HTML file, and it’s not a problem that it’s available when the plugin is disabled. I’m not convinced that this is true. It seems that OJS instances with the pdfJsViewer plugin deactivated are vulnerable if a link such as https://[OJS_URL]/plug…

Hi @mkmiec , This is being used to juice SEO by causing OJS to appear as though it links to other domains. The mechanism is as follows: someone wanting to boost their site’s search engine ranking plants a link to an OJS installation somewhere that it can be indexed. The link is to the viewer.html fi…

If you are unable to update at the moment, you can use this on your webserver # ============================================ # BLOQUEAR OPEN REDIRECT en pdf.js viewer # ============================================ # RewriteCond %{REQUEST_URI} ^/plugins/generic/pdfJsViewer/pdf\.js/web/viewer\.html…

OJS 3.4.0.8 - pdfJsViewer plugin security

Software Support

asmecher June 10, 2026, 12:23pm 6

Hi @mkmiec,

The fix is linked from the other thread:

The viewer.html file is just an HTML file, and it’s not a problem that it’s available when the plugin is disabled.

Regards,
Alec Smecher
Public Knowledge Project Team