CVE-2026-54078CWE-611

veraPDF Validation XXE via Rich Text

High · published July 29, 2026

CVSS v4.0
8.7
EPSS
1%
Percentile
45.5
In the wild
Unconfirmed
What it is

veraPDF validation model is an implementation of the veraPDF validation model. From 1.25.73 until 1.30.2 and 1.31.71, veraPDF-validation contains an XML External Entity (XXE) vulnerability in validation-model/src/main/java/org/verapdf/gf/model/tools/DictionaryKeysHelper.java in getRichTextStringOrStreamEntryStringRepresentation(), where a crafted PDF containing a malicious rich-text /RC or /RV entry can cause external entity expansion and reflect local file contents into the validation report. This issue is fixed in versions 1.30.2 and 1.31.71.

The record
Technical detail
CVSS v4.0
8.7 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00555 · 45.5th percentile
Weakness
CWE-611 · Improper Restriction of XML External Entity Reference
Published
2026-07-29T15:11Z
EPSS history
Timeline
  • 29 JUL 15:11Z
    veraPDF Validation XXE via Rich Text
    cvelistv5