Attack Chain

1. An attacker crafts a malicious PDF document containing a rich-text entry (e.g., /RC or /RV).
2. The rich-text entry embeds XML data that includes an external entity declaration, such as <!DOCTYPE foo [<!ENTITY xxe SYSTEM "file:///etc/passwd">]> or <!ENTITY xxe SYSTEM "http://internal-host/admin">].
3. The attacker delivers this crafted PDF to a target system that uses veraPDF-validation to process or validate PDF files.
4. The veraPDF-validation library, specifically the getRichTextStringOrStreamEntryStringRepresentation() method in validation-model/src/main/java/org/verapdf/gf/model/tools/DictionaryKeysHelper.java, attempts to parse the embedded XML.
5. Due to the DocumentBuilderFactory being instantiated with default, insecure settings (no disallow-doctype-decl, no disabling of external entities, no secure EntityResolver), the XML parser resolves the external entity.
6. The content of the specified external resource (e.g., /etc/passwd or the response from http://internal-host/admin) is retrieved by the vulnerable veraPDF application.
7. The getAllNodeText() method recursively concatenates all text nodes, including the expanded content of the external entity.
8. The sensitive data or response from the SSRF attempt is reflected directly into the validation report or the output generated by veraPDF, allowing the attacker to exfiltrate it.

Impact

Successful exploitation of CVE-2026-54078 allows a remote attacker to read arbitrary files from the compromised server's file system, potentially exfiltrating sensitive data such as configuration files, user credentials, or application source code. Additionally, the Server-Side Request Forgery (SSRF) capability enables the attacker to initiate requests to internal network resources, bypassing firewall rules and potentially gaining access to internal services or hosts that are not directly exposed to the internet. This could lead to further reconnaissance, lateral movement, or data exfiltration from the internal infrastructure. All current releases of the veraPDF validation-model module are affected, meaning a wide range of systems performing PDF validation are vulnerable to this attack.

Recommendation

• Patch CVE-2026-54078 immediately by updating maven/org.verapdf:validation-model and maven/org.verapdf:validation-model-jakarta to a fixed version as soon as one is available.
• Implement secure XML parsing practices in applications handling untrusted XML, specifically hardening DocumentBuilderFactory configurations to disallow DOCTYPE declarations and external entity resolution.
• Monitor application logs for unusual file access patterns or outbound connections initiated by the veraPDF process that could indicate successful SSRF or file exfiltration attempts related to the vulnerability described in this brief.