CVE-2026-54079
HighCVSS 8.7Exploitation Probability (EPSS)
Low risk24th percentile - higher than 24% of all known CVEs
Summary
An XML External Entity (XXE) vulnerability in veraPDF-validation exists in the getdynamicRender() method in GFPDAcroForm.java. A crafted PDF with a malicious XFA stream can cause external entity expansion during PDF/UA-1 validation, leading to local file disclosure or outbound server-side requests.
Risk Assessment
An attacker can read sensitive files from the server or use it to attack other systems (SSRF), compromising data confidentiality and integrity.
Recommendation
Update veraPDF-validation to version 1.30.2 or 1.31.71, which contain the fix for the XXE vulnerability.
Other vulnerabilities in veraPDF-validation
See all- CVE-2026-54082Medium
An XML External Entity (XXE) vulnerability in the veraPDF-validation library allows an attacker to read local files and send outbound network requests via a crafted PDF containing malicious rich-text annotations, form field values, or XFA configurations.
- CVE-2026-54078High
An XML External Entity (XXE) vulnerability in veraPDF-validation exists in the getRichTextStringOrStreamEntryStringRepresentation() method in DictionaryKeysHelper.java. A crafted PDF with a malicious rich-text /RC or /RV entry can cause external entity expansion and reflect local file contents into the validation report.
Original NVD description (English source)
veraPDF validation provides PDF/A and PDF/UA validation, feature reporting, and metadata repair. From 1.17.35 until 1.30.2 and 1.31.71, veraPDF-validation contains an XML External Entity (XXE) vulnerability in validation-model/src/main/java/org/verapdf/gf/model/impl/pd/GFPDAcroForm.java in the getdynamicRender() method, where a crafted PDF containing a malicious XFA stream can cause external entity expansion during PDF/UA-1 validation and allow local file disclosure or outbound server-side requests. This issue is fixed in versions 1.30.2 and 1.31.71.