Executive brief
veraPDF is an open-source library used to validate PDF files against archival standards. A security flaw allows specially crafted PDF files to trigger unauthorized actions when they are processed by the software. This could allow an attacker to read sensitive local files from the server or make unauthorized network requests, potentially compromising private data or internal systems.
Technical details
An XML External Entity (XXE) vulnerability exists in veraPDF-validation within the PDFAValidator.validate() and GFPDAcroForm.getdynamicRender() methods. The root cause is the use of a default DocumentBuilderFactory that does not disable DTDs or external entity expansion when parsing rich-text annotations, form-field values, or XFA configurations. A remote, unauthenticated attacker can exploit this by providing a malicious PDF file to an application using the library. Successful exploitation can lead to local file disclosure (LFD) and Server-Side Request Forgery (SSRF) depending on the JVM environment. The issue is resolved by migrating to SecureXML.newSafeDocumentBuilder() in versions 1.30.2 and 1.31.71.
Affected products
- veraPDF veraPDF-validation >= 1.17.35, < 1.30.2; >= 1.31.1, < 1.31.71
- veraPDF validation-model-jakarta >= 1.17.35, < 1.30.2; >= 1.31.1, < 1.31.71
Timeline
- 2026-05-19: other: Fix developed in pull request
- 2026-05-28: patched: Fix merged into integration branch
- 2026-06-08: advisory: GitHub Security Advisory published
- 2026-07-29: disclosed: CVE published to NVD
References
- https://github.com/veraPDF/veraPDF-validation/commit/94caa46c1a594512247fbd46c808edae39469542
- https://github.com/veraPDF/veraPDF-validation/commit/cacd9436d0de40b0e58cc7d2dbb06451619e61ec
- https://github.com/veraPDF/veraPDF-validation/pull/730
- https://github.com/veraPDF/veraPDF-validation/security/advisories/GHSA-cg9x-g3gm-h5h6