Read the docs
TI-2026-39012 Aliases CVE-2026-54082GHSA-cg9x-g3gm-h5h6

veraPDF-validatio: Use of Default `DocumentBuilderFactory` leads to XXE When Processing Untrusted PDFs

Priority LOW 35CWE-611Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.

Summary

veraPDF validation model is an implementation of the veraPDF validation model. From 1.25.73 until 1.30.2 and 1.31.71, veraPDF-validation contains an XML External Entity vulnerability in PDFAValidator.validate(...) and GFPDAcroForm.getdynamicRender(), where default DocumentBuilderFactory parsing of rich-text annotation or form-field values and XFA configurations in untrusted PDFs can allow local file disclosure and outbound network requests. This issue is fixed in versions 1.30.2 and 1.31.71.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00395 33rd percentileScored 2026-11-07
Fix Fixed veraPDF-validation (veraPDF): 1.30.2, 1.31.71org.verapdf:validation-model (Maven): 1.30.2, 1.31.71+1 more product

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
veraPDFveraPDF-validation1.17.35 to before 1.30.2; 1.31.1 to before 1.31.711.30.2, 1.31.71Patch availableCNA
—org.verapdf:validation-model (Maven)1.17.35 to before 1.30.21.30.2Patch availableGHSA-cg9x-g3gm-h5h6
—org.verapdf:validation-model (Maven)1.31.1 to before 1.31.711.31.71Patch availableGHSA-cg9x-g3gm-h5h6
—org.verapdf:validation-model-jakarta (Maven)1.17.35 to before 1.30.21.30.2Patch availableGHSA-cg9x-g3gm-h5h6
—org.verapdf:validation-model-jakarta (Maven)1.31.1 to before 1.31.711.31.71Patch availableGHSA-cg9x-g3gm-h5h6
  • veraPDF-validation VendorveraPDF Affected 1.17.35 to before 1.30.2; 1.31.1 to before 1.31.71 Fixed in 1.30.2, 1.31.71 Patch available CNA
  • org.verapdf:validation-model (Maven) Vendor— Affected 1.17.35 to before 1.30.2 Fixed in 1.30.2 Patch available GHSA-cg9x-g3gm-h5h6
  • org.verapdf:validation-model (Maven) Vendor— Affected 1.31.1 to before 1.31.71 Fixed in 1.31.71 Patch available GHSA-cg9x-g3gm-h5h6
  • org.verapdf:validation-model-jakarta (Maven) Vendor— Affected 1.17.35 to before 1.30.2 Fixed in 1.30.2 Patch available GHSA-cg9x-g3gm-h5h6
  • org.verapdf:validation-model-jakarta (Maven) Vendor— Affected 1.31.1 to before 1.31.71 Fixed in 1.31.71 Patch available GHSA-cg9x-g3gm-h5h6

Remediation

  • Fix · CNA veraPDF-validation (veraPDF) Fixed in 1.30.2, 1.31.71
  • Fix · GHSA-cg9x-g3gm-h5h6 org.verapdf:validation-model (Maven) Fixed in 1.30.2 Advisory →
  • Fix · GHSA-cg9x-g3gm-h5h6 org.verapdf:validation-model (Maven) Fixed in 1.31.71 Advisory →
  • Fix · GHSA-cg9x-g3gm-h5h6 org.verapdf:validation-model-jakarta (Maven) Fixed in 1.30.2 Advisory →
  • Fix · GHSA-cg9x-g3gm-h5h6 org.verapdf:validation-model-jakarta (Maven) Fixed in 1.31.71 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-54082
  2. 2026-10-03 Alias added: GHSA-cg9x-g3gm-h5h6

References

Other 5

  • TI-2026-39009 veraPDF Validation XXE via XFA CVSS 4.0HIGH 8.7
  • TI-2026-39008 veraPDF Validation XXE via Rich Text CVSS 4.0HIGH 8.7
  • TI-2024-18689 Potential XSLT injection vulnerability when using policy files CVSS 3.1HIGH 8.1
  • TI-2026-39011 veraPDF Parser DoS via PostScript Type 1 Font Programs CVSS 4.0MEDIUM 6.9
  • TI-2026-39010 veraPDF Parser DoS via PostScript CMap Streams CVSS 4.0MEDIUM 6.9
  • TI-2024-35313 Potential XXE (XML External Entity Injection) vulnerability in veraPDF CLI CVSS 4.0LOW 2.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences