CVE-2026-54078

Received Received - Intake

XML External Entity Injection in veraPDF Validation Model

Publication date: 2026-07-29

Last updated on: 2026-07-29

Assigner: GitHub, Inc.

Description

veraPDF validation model is an implementation of the veraPDF validation model. From 1.25.73 until 1.30.2 and 1.31.71, veraPDF-validation contains an XML External Entity (XXE) vulnerability in validation-model/src/main/java/org/verapdf/gf/model/tools/DictionaryKeysHelper.java in getRichTextStringOrStreamEntryStringRepresentation(), where a crafted PDF containing a malicious rich-text /RC or /RV entry can cause external entity expansion and reflect local file contents into the validation report. This issue is fixed in versions 1.30.2 and 1.31.71.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-29

Last Modified

2026-07-29

Generated

2026-07-30

AI Q&A

2026-07-30

EPSS Evaluated

N/A

NVD

CVE-2026-54078

Affected Vendors & Products

Vendor	Product	Version / Range
verapdf	verapdf_validation	From 1.25.73 (inc) to 1.30.2 (inc)
verapdf	verapdf_validation	1.30.2
verapdf	verapdf_validation	1.31.71

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-611	The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.

Attack-Flow Graph

Executive Summary

This is an XML External Entity (XXE) vulnerability in the veraPDF validation model. It affects versions between 1.25.73 and 1.30.2, and 1.31.71. A crafted PDF with malicious rich-text entries (/RC or /RV) can cause external entity expansion, allowing the extraction of local file contents into validation reports.

Detection Guidance

Detecting this XXE vulnerability requires checking for vulnerable versions of veraPDF-validation (1.25.73 to 1.30.2 or 1.31.71). Inspect PDFs processed by veraPDF for malicious /RC or /RV entries in rich-text strings. Use commands like 'verapdf --version' to check installed versions and scan PDFs with tools like 'pdfinfo' or 'pdf-parser.py' for suspicious entries.

Impact Analysis

An attacker could exploit this to read sensitive files on the system running veraPDF. This may lead to unauthorized data exposure, including configuration files or other confidential information. The impact depends on the privileges of the user running the application.

Compliance Impact

This vulnerability could lead to data breaches, violating GDPR's data protection requirements or HIPAA's privacy rules. Organizations using affected versions may face compliance violations, legal penalties, and reputational damage due to unauthorized data exposure.

Mitigation Strategies

Upgrade veraPDF-validation to versions 1.30.2 or 1.31.71 or later. Remove or restrict access to PDFs containing rich-text /RC or /RV entries until updated. Disable XML external entity processing in XML parsers if used by veraPDF. Monitor logs for unusual file access patterns during PDF validation.

Hi! I’m here to help you understand CVE-2026-54078. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70