CVE-2026-54078High▾ TwilightveraPDF Validation XXE via Rich Text
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 30.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via GHSA
0.3%
Description An XML External Entity Injection (CWE-611) vulnerability in veraPDF allows a remote attacker to read arbitrary files on the server file system and perform Server-Side Request Forgery by submitting a crafted PDF containing a malicious rich-text (/RC or /RV) entry. This affects all current versions of veraPDF-validation.
The vulnerability resides in veraPDF-validation validation-model/src/main/java/org/verapdf/gf/model/tools/DictionaryKeysHelper.java within the getRichTextStringOrStreamEntryStringRepresentation() method. This helper extracts the XHTML rich-text body from a PDF dictionary string or stream and parses it with a DOM parser to return the concatenated text content.
The vulnerability stems from two combined issues:
<!DOCTYPE … SYSTEM "…"> and <!ENTITY … SYSTEM "…"> declarations.getAllNodeText() recursively concatenates every text node in the document and returns it as the model property value. This means the expanded contents of any external entity are reflected directly back into the validation report.This impacts all current releases of the veraPDF validation-model module.
Successful exploitation requires only that the target validate an attacker-supplied PDF. A single markup annotation with a crafted /RC string is sufficient.
Harden the DocumentBuilderFactory in validation-model/src/main/java/org/verapdf/gf/model/tools/DictionaryKeysHelper.java per the OWASP XXE Prevention Cheat Sheet to disallow DOCTYPE outright.
org.verapdf:validation-model >= 1.25.73, <= 1.30.1org.verapdf:validation-model >= 1.31.1, <= 1.31.70org.verapdf:validation-model-jakarta >= 1.25.73, <= 1.30.1org.verapdf:validation-model-jakarta >= 1.31.1, <= 1.31.70Upgrade to a patched release:
org.verapdf:validation-model 1.30.2org.verapdf:validation-model 1.31.71org.verapdf:validation-model-jakarta 1.30.2org.verapdf:validation-model-jakarta 1.31.71Connected by shared product, vendor, weakness, or advisory.
CVE-2026-54079HighveraPDF Validation XXE via XFA
CVE-2026-54082Medium· 6.5veraPDF-validatio: Use of Default `DocumentBuilderFactory` leads to XXE When Processing Untrusted PDFs
CVE-2019-3773Critical· 9.8Spring Web Services, versions 2.4.3, 3.0.4, and older unsupported versions of all three projects, were susceptible to XML External Entity Injection (XXE) when receiving XML data from untrusted sources.
CVE-2019-3774Critical· 9.8Spring Batch versions 3.0.9, 4.0.1, 4.1.0, and older unsupported versions, were susceptible to XML External Entity Injection (XXE) when receiving XML data from untrusted sources.
CVE-2026-12975High· 8.5A flaw was found in Apicurio Registry
CVE-2020-25649High· 7.5A flaw was found in FasterXML Jackson Databind, where it did not have entity expansion secured properly