veraPDF Validation XXE via XFA
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-611 and the CVSS impact.
Summary
veraPDF validation provides PDF/A and PDF/UA validation, feature reporting, and metadata repair. From 1.17.35 until 1.30.2 and 1.31.71, veraPDF-validation contains an XML External Entity (XXE) vulnerability in validation-model/src/main/java/org/verapdf/gf/model/impl/pd/GFPDAcroForm.java in the getdynamicRender() method, where a crafted PDF containing a malicious XFA stream can cause external entity expansion during PDF/UA-1 validation and allow local file disclosure or outbound server-side requests. This issue is fixed in versions 1.30.2 and 1.31.71.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| veraPDF | veraPDF-validation | 1.17.35 to before 1.30.2; 1.31.1 to before 1.31.71 | 1.30.2, 1.31.71 | Patch available | CNA |
| — | org.verapdf:validation-model (Maven) | 1.17.35 to before 1.30.2 | 1.30.2 | Patch available | GHSA-36mm-w85j-3q2j |
| — | org.verapdf:validation-model (Maven) | 1.31.1 to before 1.31.71 | 1.31.71 | Patch available | GHSA-36mm-w85j-3q2j |
| — | org.verapdf:validation-model-jakarta (Maven) | 1.17.35 to before 1.30.2 | 1.30.2 | Patch available | GHSA-36mm-w85j-3q2j |
| — | org.verapdf:validation-model-jakarta (Maven) | 1.31.1 to before 1.31.71 | 1.31.71 | Patch available | GHSA-36mm-w85j-3q2j |
- veraPDF-validation VendorveraPDF Affected 1.17.35 to before 1.30.2; 1.31.1 to before 1.31.71 Fixed in 1.30.2, 1.31.71 Patch available CNA
- org.verapdf:validation-model (Maven) Vendor— Affected 1.17.35 to before 1.30.2 Fixed in 1.30.2 Patch available GHSA-36mm-w85j-3q2j
- org.verapdf:validation-model (Maven) Vendor— Affected 1.31.1 to before 1.31.71 Fixed in 1.31.71 Patch available GHSA-36mm-w85j-3q2j
- org.verapdf:validation-model-jakarta (Maven) Vendor— Affected 1.17.35 to before 1.30.2 Fixed in 1.30.2 Patch available GHSA-36mm-w85j-3q2j
- org.verapdf:validation-model-jakarta (Maven) Vendor— Affected 1.31.1 to before 1.31.71 Fixed in 1.31.71 Patch available GHSA-36mm-w85j-3q2j
Remediation
- Fix · CNA veraPDF-validation (veraPDF) Fixed in 1.30.2, 1.31.71
- Fix · GHSA-36mm-w85j-3q2j org.verapdf:validation-model (Maven) Fixed in 1.30.2 Advisory →
- Fix · GHSA-36mm-w85j-3q2j org.verapdf:validation-model (Maven) Fixed in 1.31.71 Advisory →
- Fix · GHSA-36mm-w85j-3q2j org.verapdf:validation-model-jakarta (Maven) Fixed in 1.30.2 Advisory →
- Fix · GHSA-36mm-w85j-3q2j org.verapdf:validation-model-jakarta (Maven) Fixed in 1.31.71 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2026-54079
- 2026-10-03 Alias added: GHSA-36mm-w85j-3q2j
References
Other 5
- https://github.com/veraPDF/veraPDF-validation/security/advisories/GHSA-36mm-w85j-3q2j
- https://github.com/veraPDF/veraPDF-validation/pull/730
- https://github.com/veraPDF/veraPDF-validation/commit/94caa46c1a594512247fbd46c808edae39469542
- https://github.com/veraPDF/veraPDF-validation/commit/cacd9436d0de40b0e58cc7d2dbb06451619e61ec
- https://github.com/veraPDF/veraPDF-validation
More veraPDF vulnerabilities
- TI-2026-39008 veraPDF Validation XXE via Rich Text CVSS 4.0HIGH 8.7
- TI-2024-18689 Potential XSLT injection vulnerability when using policy files CVSS 3.1HIGH 8.1
- TI-2026-39011 veraPDF Parser DoS via PostScript Type 1 Font Programs CVSS 4.0MEDIUM 6.9
- TI-2026-39010 veraPDF Parser DoS via PostScript CMap Streams CVSS 4.0MEDIUM 6.9
- TI-2026-39012 veraPDF-validatio: Use of Default `DocumentBuilderFactory` leads to XXE When Processing Untrusted PDFs CVSS 3.1MEDIUM 6.5
- TI-2024-35313 Potential XXE (XML External Entity Injection) vulnerability in veraPDF CLI CVSS 4.0LOW 2.3
Sources
- CVE-2026-54079 · CVE Program
- CVE-2026-54079 · NVD
- FIRST EPSS
- GHSA-36mm-w85j-3q2j · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences