CVE-2026-54078: veraPDF XXE vulnerability in rich-text validation

CVE-2026-54078 · Severity: high · CVSS 4 · Published 2026-07-29

veraPDF is an open-source software library used to validate PDF files against industry standards. A security flaw allows an attacker to provide a specially crafted PDF file that, when processed by the software, can trick the system into revealing sensitive local files or performing unauthorized internal network requests. This could lead to the exposure of confidential data or provide a foothold for further attacks on the organization's infrastructure.

Technologies: org.verapdf:validation-model (Maven), org.verapdf:validation-model-jakarta (Maven), veraPDF Validation-Model, veraPDF Validation-Model-Jakarta, veraPDF-validation. Vendors: Maven, veraPDF.

Quick answers

Is CVE-2026-54078 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-54078 being exploited in the wild.
How severe is CVE-2026-54078?
High severity, with a CVSS score of 4, published 29 July 2026.
Which products and versions are affected?
org.verapdf:validation-model (Maven) ECOSYSTEM:introduced=1.25.73,fixed=1.30.2; org.verapdf:validation-model-jakarta (Maven) ECOSYSTEM:introduced=1.25.73,fixed=1.30.2; veraPDF Validation-Model >= 1.25.73, <= 1.30.1; veraPDF Validation-Model-Jakarta >= 1.25.73, < 1.30.2; >= 1.31.1, < 1.31.71, >= 1.25.73, <= 1.30.1; and 1 more.
Is there a fix for CVE-2026-54078?
Yes. org.verapdf:validation-model (Maven): upgrade to 1.30.2 or later; org.verapdf:validation-model-jakarta (Maven): upgrade to 1.30.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-54078 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-54078?
Check whether you run org.verapdf:validation-model (Maven), org.verapdf:validation-model-jakarta (Maven), veraPDF Validation-Model or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • org.verapdf:validation-model (Maven): upgrade to 1.30.2 or later
    # set org.verapdf:validation-model to 1.30.2 in your pom.xml or build.gradle
  • org.verapdf:validation-model-jakarta (Maven): upgrade to 1.30.2 or later
    # set org.verapdf:validation-model-jakarta to 1.30.2 in your pom.xml or build.gradle

Technical details

An XML External Entity (XXE) vulnerability exists in the veraPDF-validation library, specifically within the DictionaryKeysHelper.java component's getRichTextStringOrStreamEntryStringRepresentation() method. The root cause is an insecurely configured DocumentBuilderFactory that fails to disable DTDs or external entity resolution when parsing XHTML rich-text (/RC or /RV) entries from PDF dictionaries. An attacker can exploit this by submitting a crafted PDF containing malicious XML entities; the parser will resolve these entities and reflect the contents of local files or internal network resources directly into the resulting validation report. The issue has been addressed in versions 1.30.2 and 1.31.71 by implementing secure XML parsing defaults.

Affected products

  • veraPDF veraPDF-validation >= 1.25.73, < 1.30.2; >= 1.31.1, < 1.31.71
  • veraPDF validation-model-jakarta >= 1.25.73, < 1.30.2; >= 1.31.1, < 1.31.71

Identifiers

  • CVE-2026-54078
  • GHSA-3jh7-wm29-q568

Timeline

  • 2026-05-28: patched: Fix merged into integration branch
  • 2026-06-08: advisory: GitHub Security Advisory published
  • 2026-07-29: disclosed: CVE published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.