CVE-2026-54078
HighCVSS 8.7Exploitation Probability (EPSS)
Low risk24th percentile - higher than 24% of all known CVEs
Summary
An XML External Entity (XXE) vulnerability in veraPDF-validation exists in the getRichTextStringOrStreamEntryStringRepresentation() method in DictionaryKeysHelper.java. A crafted PDF with a malicious rich-text /RC or /RV entry can cause external entity expansion and reflect local file contents into the validation report.
Risk Assessment
An attacker can read sensitive data from the server by injecting XML entities, compromising information confidentiality.
Recommendation
Update veraPDF-validation to version 1.30.2 or 1.31.71, which fix this XXE vulnerability.
Other vulnerabilities in veraPDF-validation
See all- CVE-2026-54082Medium
An XML External Entity (XXE) vulnerability in the veraPDF-validation library allows an attacker to read local files and send outbound network requests via a crafted PDF containing malicious rich-text annotations, form field values, or XFA configurations.
- CVE-2026-54079High
An XML External Entity (XXE) vulnerability in veraPDF-validation exists in the getdynamicRender() method in GFPDAcroForm.java. A crafted PDF with a malicious XFA stream can cause external entity expansion during PDF/UA-1 validation, leading to local file disclosure or outbound server-side requests.
Original NVD description (English source)
veraPDF validation model is an implementation of the veraPDF validation model. From 1.25.73 until 1.30.2 and 1.31.71, veraPDF-validation contains an XML External Entity (XXE) vulnerability in validation-model/src/main/java/org/verapdf/gf/model/tools/DictionaryKeysHelper.java in getRichTextStringOrStreamEntryStringRepresentation(), where a crafted PDF containing a malicious rich-text /RC or /RV entry can cause external entity expansion and reflect local file contents into the validation report. This issue is fixed in versions 1.30.2 and 1.31.71.