Potential XXE (XML External Entity Injection) vulnerability in veraPDF CLI
Priority LOW 14CWE-611Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Passive
- Attack complexity
- Low
- Attack requirements
- Present
- Impact type
- —
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub.
Summary
veraPDF is an open source PDF/A validation library. Executing policy checks using custom schematron files via the CLI invokes an XSL transformation that may theoretically lead to a remote code execution (RCE) vulnerability. This doesn't affect the standard validation and policy checks functionality, veraPDF's common use cases. Most veraPDF users don't insert any custom XSLT code into policy profiles, which are based on Schematron syntax rather than direct XSL transforms. For users who do, only load custom policy files from sources you trust. This issue has not yet been patched. Users are advised to be cautious of XSLT code until a patch is available.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01108 66th percentileScored 2026-11-07
Fix Fixed org.verapdf:core (Maven): 1.26.2org.verapdf:core-jakarta (Maven): 1.26.2+7 more products
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| veraPDF | veraPDF-library | up to 1.26.1 | — | No fix listed | CNA |
| — | org.verapdf:core (Maven) | before 1.26.2 | 1.26.2 | Patch available | GHSA-4cx5-89vm-833x |
| — | org.verapdf:core-jakarta (Maven) | before 1.26.2 | 1.26.2 | Patch available | GHSA-4cx5-89vm-833x |
| — | org.verapdf:core-arlington (Maven) | before 1.26.2 | 1.26.2 | Patch available | GHSA-4cx5-89vm-833x |
| — | org.verapdf:verapdf-library (Maven) | before 1.26.2 | 1.26.2 | Patch available | GHSA-4cx5-89vm-833x |
| — | org.verapdf:verapdf-library-jakarta (Maven) | before 1.26.2 | 1.26.2 | Patch available | GHSA-4cx5-89vm-833x |
| — | org.verapdf:verapdf-library-arlington (Maven) | before 1.26.2 | 1.26.2 | Patch available | GHSA-4cx5-89vm-833x |
| — | org.verapdf:library (Maven) | before 1.26.2 | 1.26.2 | Patch available | GHSA-4cx5-89vm-833x |
| — | org.verapdf:library-jakarta (Maven) | before 1.26.2 | 1.26.2 | Patch available | GHSA-4cx5-89vm-833x |
| — | org.verapdf:library-arlington (Maven) | before 1.26.2 | 1.26.2 | Patch available | GHSA-4cx5-89vm-833x |
- veraPDF-library VendorveraPDF Affected up to 1.26.1 Fixed in — No fix listed CNA
- org.verapdf:core (Maven) Vendor— Affected before 1.26.2 Fixed in 1.26.2 Patch available GHSA-4cx5-89vm-833x
- org.verapdf:core-jakarta (Maven) Vendor— Affected before 1.26.2 Fixed in 1.26.2 Patch available GHSA-4cx5-89vm-833x
- org.verapdf:core-arlington (Maven) Vendor— Affected before 1.26.2 Fixed in 1.26.2 Patch available GHSA-4cx5-89vm-833x
- org.verapdf:verapdf-library (Maven) Vendor— Affected before 1.26.2 Fixed in 1.26.2 Patch available GHSA-4cx5-89vm-833x
- org.verapdf:verapdf-library-jakarta (Maven) Vendor— Affected before 1.26.2 Fixed in 1.26.2 Patch available GHSA-4cx5-89vm-833x
- org.verapdf:verapdf-library-arlington (Maven) Vendor— Affected before 1.26.2 Fixed in 1.26.2 Patch available GHSA-4cx5-89vm-833x
- org.verapdf:library (Maven) Vendor— Affected before 1.26.2 Fixed in 1.26.2 Patch available GHSA-4cx5-89vm-833x
- org.verapdf:library-jakarta (Maven) Vendor— Affected before 1.26.2 Fixed in 1.26.2 Patch available GHSA-4cx5-89vm-833x
- org.verapdf:library-arlington (Maven) Vendor— Affected before 1.26.2 Fixed in 1.26.2 Patch available GHSA-4cx5-89vm-833x
Remediation
- Fix · GHSA-4cx5-89vm-833x org.verapdf:core (Maven) Fixed in 1.26.2 Advisory →
- Fix · GHSA-4cx5-89vm-833x org.verapdf:core-jakarta (Maven) Fixed in 1.26.2 Advisory →
- Fix · GHSA-4cx5-89vm-833x org.verapdf:core-arlington (Maven) Fixed in 1.26.2 Advisory →
- Fix · GHSA-4cx5-89vm-833x org.verapdf:verapdf-library (Maven) Fixed in 1.26.2 Advisory →
- Fix · GHSA-4cx5-89vm-833x org.verapdf:verapdf-library-jakarta (Maven) Fixed in 1.26.2 Advisory →
- Fix · GHSA-4cx5-89vm-833x org.verapdf:verapdf-library-arlington (Maven) Fixed in 1.26.2 Advisory →
- Fix · GHSA-4cx5-89vm-833x org.verapdf:library (Maven) Fixed in 1.26.2 Advisory →
- Fix · GHSA-4cx5-89vm-833x org.verapdf:library-jakarta (Maven) Fixed in 1.26.2 Advisory →
- Fix · GHSA-4cx5-89vm-833x org.verapdf:library-arlington (Maven) Fixed in 1.26.2 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2024-52800
- 2026-10-03 Alias added: GHSA-4cx5-89vm-833x
References
More veraPDF vulnerabilities
- TI-2026-39009 veraPDF Validation XXE via XFA CVSS 4.0HIGH 8.7
- TI-2026-39008 veraPDF Validation XXE via Rich Text CVSS 4.0HIGH 8.7
- TI-2024-18689 Potential XSLT injection vulnerability when using policy files CVSS 3.1HIGH 8.1
- TI-2026-39011 veraPDF Parser DoS via PostScript Type 1 Font Programs CVSS 4.0MEDIUM 6.9
- TI-2026-39010 veraPDF Parser DoS via PostScript CMap Streams CVSS 4.0MEDIUM 6.9
- TI-2026-39012 veraPDF-validatio: Use of Default `DocumentBuilderFactory` leads to XXE When Processing Untrusted PDFs CVSS 3.1MEDIUM 6.5
Sources
- CVE-2024-52800 · CVE Program
- CVE-2024-52800 · NVD
- FIRST EPSS
- GHSA-4cx5-89vm-833x · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences