CVE-2026-54078

Name of the Vulnerable Software and Affected Versions veraPDF versions 1.25.73 through 1.30.1 veraPDF versions 1.31.0 through 1.31.70

Description An XML External Entity (XXE) injection issue exists in the validation-model/src/main/java/org/verapdf/gf/model/tools/DictionaryKeysHelper.java file within the getRichTextStringOrStreamEntryStringRepresentation() function. The issue occurs because the DocumentBuilderFactory is instantiated with default settings that allow the resolution of DOCTYPE and external entity declarations. A remote attacker can exploit this by submitting a crafted PDF containing a malicious rich-text /RC or /RV entry, leading to external entity expansion. This allows the attacker to read arbitrary files from the server file system and perform Server-Side Request Forgery (SSRF), where the expanded contents are reflected in the validation report.

Recommendations Update to version 1.30.2. Update to version 1.31.71. As a temporary mitigation, restrict the processing of PDFs containing rich-text /RC or /RV entries until the updates are applied.