veraPDF-validation vulnerabilities
3 known CVE vulnerabilities in veraPDF-validation, translated and rated.
- CVE-2026-54082Medium
An XML External Entity (XXE) vulnerability in the veraPDF-validation library allows an attacker to read local files and send outbound network requests via a crafted PDF containing malicious rich-text annotations, form field values, or XFA configurations.
- CVE-2026-54079High
An XML External Entity (XXE) vulnerability in veraPDF-validation exists in the getdynamicRender() method in GFPDAcroForm.java. A crafted PDF with a malicious XFA stream can cause external entity expansion during PDF/UA-1 validation, leading to local file disclosure or outbound server-side requests.
- CVE-2026-54078High
An XML External Entity (XXE) vulnerability in veraPDF-validation exists in the getRichTextStringOrStreamEntryStringRepresentation() method in DictionaryKeysHelper.java. A crafted PDF with a malicious rich-text /RC or /RV entry can cause external entity expansion and reflect local file contents into the validation report.