{"id":"CVE-2026-54079","aliases":["EUVD-2026-50368","GHSA-36mm-w85j-3q2j"],"status":"published","title":"veraPDF Validation XXE via XFA","description":"veraPDF validation provides PDF/A and PDF/UA validation, feature reporting, and metadata repair. From 1.17.35 until 1.30.2 and 1.31.71, veraPDF-validation contains an XML External Entity (XXE) vulnerability in validation-model/src/main/java/org/verapdf/gf/model/impl/pd/GFPDAcroForm.java in the getdynamicRender() method, where a crafted PDF containing a malicious XFA stream can cause external entity expansion during PDF/UA-1 validation and allow local file disclosure or outbound server-side requests. This issue is fixed in versions 1.30.2 and 1.31.71.","severity":{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-07","score":0.00555,"percentile":0.46528,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-611"],"published":"2026-07-29T15:07:23Z","modified":"2026-10-28T11:16:41Z","fixes":[{"ecosystem":"Maven","package":"org.verapdf:validation-model","fixed_in":["1.30.2","1.31.71"],"sources":["ghsa","osv"]},{"ecosystem":"Maven","package":"org.verapdf:validation-model-jakarta","fixed_in":["1.30.2","1.31.71"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.verapdf:validation-model","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.17.35"},{"last_affected":"1.30.1"},{"fixed":"1.30.2"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.verapdf:validation-model","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.31.1"},{"last_affected":"1.31.70"},{"fixed":"1.31.71"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.verapdf:validation-model-jakarta","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.17.35"},{"last_affected":"1.30.1"},{"fixed":"1.30.2"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.verapdf:validation-model-jakarta","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.31.1"},{"last_affected":"1.31.70"},{"fixed":"1.31.71"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.verapdf:validation-model","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.17.35"},{"fixed":"1.30.2"}]}],"versions":["1.18.1","1.18.2","1.18.7","1.18.8","1.20.1","1.20.2","1.22.1","1.22.2","1.24.1","1.24.2","1.26.1","1.26.2","1.26.5","1.28.1","1.28.2","1.30.1"]},{"source":"osv","ecosystem":"Maven","package":"org.verapdf:validation-model","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.31.1"},{"fixed":"1.31.71"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.verapdf:validation-model-jakarta","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.17.35"},{"fixed":"1.30.2"}]}],"versions":["1.24.1","1.24.2","1.26.1","1.26.2","1.26.5","1.28.1","1.28.2","1.30.1"]},{"source":"osv","ecosystem":"Maven","package":"org.verapdf:validation-model-jakarta","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.31.1"},{"fixed":"1.31.71"}]}]}],"products":[{"vendor":"verapdf","product":"verapdf-validation"}],"references":[{"url":"https://github.com/veraPDF/veraPDF-validation/security/advisories/GHSA-36mm-w85j-3q2j","tags":["x_refsource_CONFIRM","advisory","web"]},{"url":"https://github.com/veraPDF/veraPDF-validation/pull/730","tags":["x_refsource_MISC","fix","web"]},{"url":"https://github.com/veraPDF/veraPDF-validation/commit/94caa46c1a594512247fbd46c808edae39469542","tags":["x_refsource_MISC","fix","web"]},{"url":"https://github.com/veraPDF/veraPDF-validation/commit/cacd9436d0de40b0e58cc7d2dbb06451619e61ec","tags":["x_refsource_MISC","fix","web"]},{"url":"https://github.com/advisories/GHSA-36mm-w85j-3q2j"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54079.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-54079","tags":["advisory"]},{"url":"https://github.com/veraPDF/veraPDF-validation","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-54079","title":"veraPDF Validation XXE via XFA","description":"veraPDF validation provides PDF/A and PDF/UA validation, feature reporting, and metadata repair. From 1.17.35 until 1.30.2 and 1.31.71, veraPDF-validation contains an XML External Entity (XXE) vulnerability in validation-model/src/main/java/org/verapdf/gf/model/impl/pd/GFPDAcroForm.java in the getdynamicRender() method, where a crafted PDF containing a malicious XFA stream can cause external entity expansion during PDF/UA-1 validation and allow local file disclosure or outbound server-side requests. This issue is fixed in versions 1.30.2 and 1.31.71.","status":"published","published":"2026-07-29T15:07:23.558Z","modified":"2026-07-29T15:44:57.528Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"high","assessor":"cna"}],"cwes":["CWE-611"],"updated_at":"2026-11-02T13:37:58.613221Z"}],"euvd":[{"id":"EUVD-2026-50368","description":"veraPDF validation provides PDF/A and PDF/UA validation, feature reporting, and metadata repair. From 1.17.35 until 1.30.2 and 1.31.71, veraPDF-validation contains an XML External Entity (XXE) vulnerability in validation-model/src/main/java/org/verapdf/gf/model/impl/pd/GFPDAcroForm.java in the getdynamicRender() method, where a crafted PDF containing a malicious XFA stream can cause external entity expansion during PDF/UA-1 validation and allow local file disclosure or outbound server-side requests. This issue is fixed in versions 1.30.2 and 1.31.71.","status":"published","published":"2026-07-29T15:07:23Z","modified":"2026-07-29T15:44:57Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T18:02:29.807737Z"}],"ghsa":[{"id":"GHSA-36mm-w85j-3q2j","title":"veraPDF Validation XXE via XFA","description":"## Summary  \n  \n**Description**\nAn XML External Entity Injection (CWE-611) vulnerability in veraPDF allows a remote attacker to read arbitrary files on the server file system and perform Server-Side Request Forgery by submitting a crafted PDF containing a malicious XFA stream. This affects all current versions of veraPDF-validation.  \n  \n## Details  \nThe vulnerability resides in veraPDF-validation `validation-model/src/main/java/org/verapdf/gf/model/impl/pd/GFPDAcroForm.java` within the `getdynamicRender()` method. This method retrieves the /XFA entry from the PDF's /AcroForm dictionary, decodes the embedded XML stream, and parses it to extract the `\u003cdynamicRender\u003e` element value.  \n  \nThe vulnerability stems from the use of a default-configured `DocumentBuilderFactory` to parse fully attacker-controlled XML:  \n- The factory is created via `DocumentBuilderFactory.newInstance()` with no security features enabled. disallow-doctype-decl, external-general-entities, external-parameter-entities, and FEATURE_SECURE_PROCESSING are all left at their insecure defaults.  \n- The input passed to `builder.parse()` is the decoded /XFA stream taken directly from the untrusted PDF.  \n- The text content of the `\u003cdynamicRender\u003e` node is returned to the validation model. Note that the shipped PDF/UA-1 rule (`dynamicRender != 'required'`) consumes this value but does not echo it into the report output, so reliable exfiltration requires the out-of-band parameter-entity technique described under Impact rather than in-band reflection.  \n  \n## Impact  \n  \nThis impacts all current releases of the veraPDF validation-model module.  \n  \nSuccessful exploitation requires only that the target validate an attacker-supplied PDF against the PDF/UA-1 profile (or via flavour auto-detection on a PDF that declares PDF/UA-1 conformance), since `getdynamicRender()` is invoked by the `dynamicRender != 'required'` rule in the bundled PDF/UA-1 profile. No additional configuration or operator action is required.  \n    \n## Proposed Patch  \n  \nHarden the `DocumentBuilderFactory` in `validation-model/src/main/java/org/verapdf/gf/model/impl/pd/GFPDAcroForm.java` per the OWASP XXE Prevention Cheat Sheet to disallow DOCTYPE outright.","status":"published","published":"2026-07-29T15:08:17Z","modified":"2026-07-29T15:08:18Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-611"],"updated_at":"2026-11-02T14:40:54.767849Z"}],"nvd":[{"id":"CVE-2026-54079","description":"veraPDF validation provides PDF/A and PDF/UA validation, feature reporting, and metadata repair. From 1.17.35 until 1.30.2 and 1.31.71, veraPDF-validation contains an XML External Entity (XXE) vulnerability in validation-model/src/main/java/org/verapdf/gf/model/impl/pd/GFPDAcroForm.java in the getdynamicRender() method, where a crafted PDF containing a malicious XFA stream can cause external entity expansion during PDF/UA-1 validation and allow local file disclosure or outbound server-side requests. This issue is fixed in versions 1.30.2 and 1.31.71.","status":"published","published":"2026-07-29T16:17:53.203Z","modified":"2026-10-23T23:10:00.157Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"}],"cwes":["CWE-611"],"updated_at":"2026-11-02T14:12:33.629616Z"}],"osv":[{"id":"CVE-2026-54079","title":"veraPDF Validation XXE via XFA","description":"veraPDF validation provides PDF/A and PDF/UA validation, feature reporting, and metadata repair. From 1.17.35 until 1.30.2 and 1.31.71, veraPDF-validation contains an XML External Entity (XXE) vulnerability in validation-model/src/main/java/org/verapdf/gf/model/impl/pd/GFPDAcroForm.java in the getdynamicRender() method, where a crafted PDF containing a malicious XFA stream can cause external entity expansion during PDF/UA-1 validation and allow local file disclosure or outbound server-side requests. This issue is fixed in versions 1.30.2 and 1.31.71.","status":"published","published":"2026-07-29T15:07:23.558Z","modified":"2026-10-28T11:16:41.280702252Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-611"],"updated_at":"2026-11-02T15:45:08.132336Z"},{"id":"GHSA-36mm-w85j-3q2j","title":"veraPDF Validation XXE via XFA","description":"## Summary  \n  \n**Description**\nAn XML External Entity Injection (CWE-611) vulnerability in veraPDF allows a remote attacker to read arbitrary files on the server file system and perform Server-Side Request Forgery by submitting a crafted PDF containing a malicious XFA stream. This affects all current versions of veraPDF-validation.  \n  \n## Details  \nThe vulnerability resides in veraPDF-validation `validation-model/src/main/java/org/verapdf/gf/model/impl/pd/GFPDAcroForm.java` within the `getdynamicRender()` method. This method retrieves the /XFA entry from the PDF's /AcroForm dictionary, decodes the embedded XML stream, and parses it to extract the `\u003cdynamicRender\u003e` element value.  \n  \nThe vulnerability stems from the use of a default-configured `DocumentBuilderFactory` to parse fully attacker-controlled XML:  \n- The factory is created via `DocumentBuilderFactory.newInstance()` with no security features enabled. disallow-doctype-decl, external-general-entities, external-parameter-entities, and FEATURE_SECURE_PROCESSING are all left at their insecure defaults.  \n- The input passed to `builder.parse()` is the decoded /XFA stream taken directly from the untrusted PDF.  \n- The text content of the `\u003cdynamicRender\u003e` node is returned to the validation model. Note that the shipped PDF/UA-1 rule (`dynamicRender != 'required'`) consumes this value but does not echo it into the report output, so reliable exfiltration requires the out-of-band parameter-entity technique described under Impact rather than in-band reflection.  \n  \n## Impact  \n  \nThis impacts all current releases of the veraPDF validation-model module.  \n  \nSuccessful exploitation requires only that the target validate an attacker-supplied PDF against the PDF/UA-1 profile (or via flavour auto-detection on a PDF that declares PDF/UA-1 conformance), since `getdynamicRender()` is invoked by the `dynamicRender != 'required'` rule in the bundled PDF/UA-1 profile. No additional configuration or operator action is required.  \n    \n## Proposed Patch  \n  \nHarden the `DocumentBuilderFactory` in `validation-model/src/main/java/org/verapdf/gf/model/impl/pd/GFPDAcroForm.java` per the OWASP XXE Prevention Cheat Sheet to disallow DOCTYPE outright.","status":"published","published":"2026-07-29T15:08:17Z","modified":"2026-07-29T15:27:48.935885Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-611"],"updated_at":"2026-11-02T15:46:35.406455Z"}]}}