CVE-2026-54079highCWE-611

CVE-2026-54079: falha de alta gravidade em veraPDF-validation

veraPDF Validation XXE via XFA

Publicada em

Seguir esta CVE+ Monitorar veraPDF-validation+ Monitorar org.verapdf:validation-model

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 8.7epss 0.6%
veraPDF validation provides PDF/A and PDF/UA validation, feature reporting, and metadata repair. From 1.17.35 until 1.30.2 and 1.31.71, veraPDF-validation contains an XML External Entity (XXE) vulnerability in validation-model/src/main/java/org/verapdf/gf/model/impl/pd/GFPDAcroForm.java in the getdynamicRender() method, where a crafted PDF containing a malicious XFA stream can cause external entity expansion during PDF/UA-1 validation and allow local file disclosure or outbound server-side requests. This issue is fixed in versions 1.30.2 and 1.31.71.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Produtos afetados
veraPDF · veraPDF-validation
CVEs relacionadas — veraPDF-validation

No mesmo produto, das mais perigosas para as menos.

CVE-2026-54078HIGHveraPDF Validation XXE via Rich TextEPSS 0.6%CVE-2026-54082MEDIUMveraPDF-validatio: Use of Default `DocumentBuilderFactory` leads to XXE When Processing Untrusted PDFsEPSS 0.4%