Every CVE Search/ Get API key

CVE-2024-52800

Potential XXE (XML External Entity Injection) vulnerability in veraPDF CLI

2.3 LowPublic exploitFix available

veraPDF is an open source PDF/A validation library. Executing policy checks using custom schematron files via the CLI invokes an XSL transformation that may theoretically lead to a remote code execution (RCE) vulnerability. This doesn't affect the standard validation and policy checks functionality, veraPDF's common use cases. Most veraPDF users don't insert any custom XSLT code into policy profiles, which are based on Schematron syntax rather than direct XSL transforms. For users who do, only load custom policy files from sources you trust. This issue has not yet been patched. Users are advised to be cautious of XSLT code until a patch is available.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
Passive

What an attacker can affect

Confidentiality
Low
Integrity
Low
Availability
None

Exploit likelihood

1.11%Up 1.1 points since Nov 30, 2024
90%50%10%1%

What each source reports

CVE List Score used 2.3

Potential XXE (XML External Entity Injection) vulnerability in veraPDF CLI

veraPDF is an open source PDF/A validation library. Executing policy checks using custom schematron files via the CLI invokes an XSL transformation that may theoretically lead to a remote code execution (RCE) vulnerability. This doesn't affect the standard validation and policy checks functionality, veraPDF's common use cases. Most veraPDF users don't insert any custom XSLT code into policy profiles, which are based on Schematron syntax rather than direct XSL transforms. For users who do, only load custom policy files from sources you trust. This issue has not yet been patched. Users are advised to be cautious of XSLT code until a patch is available.

Record
CVE-2024-52800
CVSS 4.0
2.3 LowCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Weakness
CWE-611
Updated
2026-11-02
EUVDEUVD-2024-3420 2.3

veraPDF is an open source PDF/A validation library. Executing policy checks using custom schematron files via the CLI invokes an XSL transformation that may theoretically lead to a remote code execution (RCE) vulnerability. This doesn't affect the standard validation and policy checks functionality, veraPDF's common use cases. Most veraPDF users don't insert any custom XSLT code into policy profiles, which are based on Schematron syntax rather than direct XSL transforms. For users who do, only load custom policy files from sources you trust. This issue has not yet been patched. Users are advised to be cautious of XSLT code until a patch is available.

Record
EUVD-2024-3420
CVSS 4.0
2.3 LowCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Updated
2026-11-03
GitHub AdvisoriesGHSA-4cx5-89vm-833x 2.3

veraPDF CLI has potential XXE (XML External Entity Injection) vulnerability

Impact

Executing policy checks using custom schematron files via the CLI invokes an XSL transformation that may theoretically lead to a remote code execution (RCE) vulnerability.

Patches

We are currently working on a patch that will be released when ready.

Workarounds

This doesn't affect the standard validation and policy checks functionality, veraPDF's common use cases. Most veraPDF users don't insert any custom XSLT code into policy profiles, which are based on Schematron syntax rather than direct XSL transforms. For users who do, only load custom policy files from sources you trust.

References

Original issue: #1488

Record
GHSA-4cx5-89vm-833x
CVSS 4.0
2.3 LowCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Weakness
CWE-611
Updated
2026-11-02
NVD 2.3

veraPDF is an open source PDF/A validation library. Executing policy checks using custom schematron files via the CLI invokes an XSL transformation that may theoretically lead to a remote code execution (RCE) vulnerability. This doesn't affect the standard validation and policy checks functionality, veraPDF's common use cases. Most veraPDF users don't insert any custom XSLT code into policy profiles, which are based on Schematron syntax rather than direct XSL transforms. For users who do, only load custom policy files from sources you trust. This issue has not yet been patched. Users are advised to be cautious of XSLT code until a patch is available.

Record
CVE-2024-52800
CVSS 4.0
2.3 LowCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness
CWE-611
Updated
2026-11-02
OSV 2.3

Potential XXE (XML External Entity Injection) vulnerability in veraPDF CLI

veraPDF is an open source PDF/A validation library. Executing policy checks using custom schematron files via the CLI invokes an XSL transformation that may theoretically lead to a remote code execution (RCE) vulnerability. This doesn't affect the standard validation and policy checks functionality, veraPDF's common use cases. Most veraPDF users don't insert any custom XSLT code into policy profiles, which are based on Schematron syntax rather than direct XSL transforms. For users who do, only load custom policy files from sources you trust. This issue has not yet been patched. Users are advised to be cautious of XSLT code until a patch is available.

Record
CVE-2024-52800
CVSS 4.0
2.3 LowCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Weakness
CWE-611
Updated
2026-11-02
OSVGHSA-4cx5-89vm-833x 2.3

veraPDF CLI has potential XXE (XML External Entity Injection) vulnerability

Impact

Executing policy checks using custom schematron files via the CLI invokes an XSL transformation that may theoretically lead to a remote code execution (RCE) vulnerability.

Patches

We are currently working on a patch that will be released when ready.

Workarounds

This doesn't affect the standard validation and policy checks functionality, veraPDF's common use cases. Most veraPDF users don't insert any custom XSLT code into policy profiles, which are based on Schematron syntax rather than direct XSL transforms. For users who do, only load custom policy files from sources you trust.

References

Original issue: #1488

Record
GHSA-4cx5-89vm-833x
CVSS 4.0
2.3 LowCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Weakness
CWE-611
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
org.verapdf:core
Maven
 through 1.26.1
1.26.2
org.verapdf:core-jakarta
Maven
 through 1.26.1
1.26.2
org.verapdf:core-arlington
Maven
 through 1.26.1
1.26.2
org.verapdf:verapdf-library-jakarta
Maven
 through 1.26.1
1.26.2
org.verapdf:verapdf-library-arlington
Maven
 through 1.26.1
1.26.2
org.verapdf:verapdf-library
Maven
 through 1.26.1
1.26.2
org.verapdf:library
Maven
 through 1.26.1
1.26.2
org.verapdf:library-jakarta
Maven
 through 1.26.1
1.26.2
org.verapdf:library-arlington
Maven
 through 1.26.1
1.26.2
org.verapdf:core
Maven
 before 1.26.2, plus listed versions
1.10.11.10.21.10.31.12.11.14.1-RC
Show 23 moreShow less
1.14.1001.14.1011.14.1021.14.1031.14.1051.14.2-RC1.14.3-RC1.14.6-RC1.16.11.18.111.18.21.18.31.20.11.20.21.22.11.22.21.24.11.24.21.26.11.4.11.6.11.6.21.8.1
1.26.2
Show 8 moreShow less
Affected packages
PackageAffectedFixed
org.verapdf:core-jakarta
Maven
 before 1.26.2, plus listed versions
1.24.11.24.21.26.1
1.26.2
org.verapdf:core-arlington
Maven
 before 1.26.2
1.26.2
org.verapdf:verapdf-library
Maven
 before 1.26.2, plus listed versions
1.10.11.10.21.10.31.12.11.14.1-RC
Show 22 moreShow less
1.14.1001.14.1011.14.1021.14.1031.14.1051.14.2-RC1.14.3-RC1.14.6-RC1.16.11.18.111.18.21.18.31.20.11.20.21.22.11.22.21.24.11.24.21.26.11.4.11.6.21.8.1
1.26.2
org.verapdf:verapdf-library-jakarta
Maven
 before 1.26.2, plus listed versions
1.24.11.24.21.26.1
1.26.2
org.verapdf:verapdf-library-arlington
Maven
 before 1.26.2
1.26.2
org.verapdf:library
Maven
 before 1.26.2
1.26.2
org.verapdf:library-jakarta
Maven
 before 1.26.2
1.26.2
org.verapdf:library-arlington
Maven
 before 1.26.2
1.26.2

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
PoC in GitHubJAckLosingHeart/GHSA-4cx5-89vm-833x-POC2024-11-30

History

History
RecordedChangedSources
aliases, publishedEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2024-52800 is a low vulnerability (CVSS 2.3) in Verapdf Verapdf-library, published November 29, 2024. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 1.11%, the 66th percentile. Fixed in org.verapdf:core 1.26.2.

References

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open