CVE-2026-54082
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk14th percentile - higher than 14% of all known CVEs
Summary
An XML External Entity (XXE) vulnerability in the veraPDF-validation library allows an attacker to read local files and send outbound network requests via a crafted PDF containing malicious rich-text annotations, form field values, or XFA configurations.
Risk Assessment
The organization is at risk of sensitive data leakage from the file system and potential use of the server to attack internal systems.
Recommendation
Immediately update the veraPDF-validation library to version 1.30.2 or 1.31.71.
Other vulnerabilities in veraPDF-validation
See all- CVE-2026-54079High
An XML External Entity (XXE) vulnerability in veraPDF-validation exists in the getdynamicRender() method in GFPDAcroForm.java. A crafted PDF with a malicious XFA stream can cause external entity expansion during PDF/UA-1 validation, leading to local file disclosure or outbound server-side requests.
- CVE-2026-54078High
An XML External Entity (XXE) vulnerability in veraPDF-validation exists in the getRichTextStringOrStreamEntryStringRepresentation() method in DictionaryKeysHelper.java. A crafted PDF with a malicious rich-text /RC or /RV entry can cause external entity expansion and reflect local file contents into the validation report.
Original NVD description (English source)
veraPDF validation model is an implementation of the veraPDF validation model. From 1.25.73 until 1.30.2 and 1.31.71, veraPDF-validation contains an XML External Entity vulnerability in PDFAValidator.validate(...) and GFPDAcroForm.getdynamicRender(), where default DocumentBuilderFactory parsing of rich-text annotation or form-field values and XFA configurations in untrusted PDFs can allow local file disclosure and outbound network requests. This issue is fixed in versions 1.30.2 and 1.31.71.