# CVE-2026-54078: veraPDF XXE vulnerability in rich-text validation

Source: https://junglewise.ai/threats/cve-2026-54078-verapdf-xxe-vulnerability-in-rich-text-validation  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-29. Updated: 2026-07-29  
License: CC BY 4.0 with a link back

CVE-2026-54078 · Severity: high · CVSS 4 · Published 2026-07-29

veraPDF is an open-source software library used to validate PDF files against industry standards. A security flaw allows an attacker to provide a specially crafted PDF file that, when processed by the software, can trick the system into revealing sensitive local files or performing unauthorized internal network requests. This could lead to the exposure of confidential data or provide a foothold for further attacks on the organization's infrastructure.

Technologies: [org.verapdf:validation-model (Maven)](https://junglewise.ai/threats/technologies/org-verapdf-validation-model), [org.verapdf:validation-model-jakarta (Maven)](https://junglewise.ai/threats/technologies/org-verapdf-validation-model-jakarta), [veraPDF Validation-Model](https://junglewise.ai/threats/technologies/validation-model), [veraPDF Validation-Model-Jakarta](https://junglewise.ai/threats/technologies/validation-model-jakarta), [veraPDF-validation](https://junglewise.ai/threats/technologies/verapdf-validation). Vendors: [Maven](https://junglewise.ai/threats/vendors/maven), [veraPDF](https://junglewise.ai/threats/vendors/verapdf).

## Quick answers

**Is CVE-2026-54078 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-54078 being exploited in the wild.

**How severe is CVE-2026-54078?** High severity, with a CVSS score of 4, published 29 July 2026.

**Which products and versions are affected?** org.verapdf:validation-model (Maven) ECOSYSTEM:introduced=1.25.73,fixed=1.30.2; org.verapdf:validation-model-jakarta (Maven) ECOSYSTEM:introduced=1.25.73,fixed=1.30.2; veraPDF Validation-Model >= 1.25.73, <= 1.30.1; veraPDF Validation-Model-Jakarta >= 1.25.73, < 1.30.2; >= 1.31.1, < 1.31.71, >= 1.25.73, <= 1.30.1; and 1 more.

**Is there a fix for CVE-2026-54078?** Yes. org.verapdf:validation-model (Maven): upgrade to 1.30.2 or later; org.verapdf:validation-model-jakarta (Maven): upgrade to 1.30.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-54078 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-54078?** Check whether you run org.verapdf:validation-model (Maven), org.verapdf:validation-model-jakarta (Maven), veraPDF Validation-Model or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- org.verapdf:validation-model (Maven): upgrade to 1.30.2 or later

  ```sh
  # set org.verapdf:validation-model to 1.30.2 in your pom.xml or build.gradle
  ```

- org.verapdf:validation-model-jakarta (Maven): upgrade to 1.30.2 or later

  ```sh
  # set org.verapdf:validation-model-jakarta to 1.30.2 in your pom.xml or build.gradle
  ```


## Technical details

An XML External Entity (XXE) vulnerability exists in the veraPDF-validation library, specifically within the DictionaryKeysHelper.java component's getRichTextStringOrStreamEntryStringRepresentation() method. The root cause is an insecurely configured DocumentBuilderFactory that fails to disable DTDs or external entity resolution when parsing XHTML rich-text (/RC or /RV) entries from PDF dictionaries. An attacker can exploit this by submitting a crafted PDF containing malicious XML entities; the parser will resolve these entities and reflect the contents of local files or internal network resources directly into the resulting validation report. The issue has been addressed in versions 1.30.2 and 1.31.71 by implementing secure XML parsing defaults.

## Affected products

- veraPDF veraPDF-validation >= 1.25.73, < 1.30.2; >= 1.31.1, < 1.31.71
- veraPDF validation-model-jakarta >= 1.25.73, < 1.30.2; >= 1.31.1, < 1.31.71

## Identifiers

- CVE-2026-54078
- GHSA-3jh7-wm29-q568

## Timeline

- 2026-05-28: patched: Fix merged into integration branch
- 2026-06-08: advisory: GitHub Security Advisory published
- 2026-07-29: disclosed: CVE published to NVD

## References

- [https://github.com/veraPDF/veraPDF-validation/commit/94caa46c1a594512247fbd46c808edae39469542](https://github.com/veraPDF/veraPDF-validation/commit/94caa46c1a594512247fbd46c808edae39469542)
- [https://github.com/veraPDF/veraPDF-validation/commit/cacd9436d0de40b0e58cc7d2dbb06451619e61ec](https://github.com/veraPDF/veraPDF-validation/commit/cacd9436d0de40b0e58cc7d2dbb06451619e61ec)
- [https://github.com/veraPDF/veraPDF-validation/pull/730](https://github.com/veraPDF/veraPDF-validation/pull/730)
- [https://github.com/veraPDF/veraPDF-validation/security/advisories/GHSA-3jh7-wm29-q568](https://github.com/veraPDF/veraPDF-validation/security/advisories/GHSA-3jh7-wm29-q568)

## Related threats

- [veraPDF XML External Entity vulnerability in PDF validation model](https://junglewise.ai/threats/cve-2026-54082-verapdf-xml-external-entity-vulnerability-in-pdf-validation-model)
- [veraPDF XML External Entity injection in XFA stream validation](https://junglewise.ai/threats/cve-2026-54079-verapdf-xml-external-entity-injection-in-xfa-stream-validation)