{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/products/validation-model-jakarta--1.25.73--1.30.1/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["validation-model (\u003e= 1.25.73, \u003c= 1.30.1)","validation-model (\u003e= 1.31.1, \u003c= 1.31.70)","validation-model-jakarta (\u003e= 1.25.73, \u003c= 1.30.1)","validation-model-jakarta (\u003e= 1.31.1, \u003c= 1.31.70)"],"_cs_severities":["high"],"_cs_tags":["xml-external-entity-injection","xxe","server-side-request-forgery","ssrf","pdf","java"],"_cs_type":"advisory","_cs_vendors":["veraPDF"],"content_html":"\u003cp\u003eA critical XML External Entity (XXE) injection vulnerability, identified as CVE-2026-54078 (CWE-611), has been discovered in the veraPDF-validation library. This vulnerability specifically impacts the \u003ccode\u003evalidation-model\u003c/code\u003e module across all current versions of veraPDF-validation. Exploitation occurs when a remote attacker crafts a malicious PDF document that includes a specially designed rich-text entry (\u003ccode\u003e/RC\u003c/code\u003e or \u003ccode\u003e/RV\u003c/code\u003e). When this crafted PDF is processed by the vulnerable veraPDF instance, an insecurely configured \u003ccode\u003eDocumentBuilderFactory\u003c/code\u003e within the \u003ccode\u003egetRichTextStringOrStreamEntryStringRepresentation()\u003c/code\u003e method fails to disable external entity resolution or DOCTYPE declarations. This allows the attacker to read arbitrary files from the server's file system and initiate Server-Side Request Forgery (SSRF) attacks, exposing sensitive information and potentially leading to further compromise of the internal network.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAn attacker crafts a malicious PDF document containing a rich-text entry (e.g., \u003ccode\u003e/RC\u003c/code\u003e or \u003ccode\u003e/RV\u003c/code\u003e).\u003c/li\u003e\n\u003cli\u003eThe rich-text entry embeds XML data that includes an external entity declaration, such as \u003ccode\u003e\u0026lt;!DOCTYPE foo [\u0026lt;!ENTITY xxe SYSTEM \u0026quot;file:///etc/passwd\u0026quot;\u0026gt;]\u0026gt;\u003c/code\u003e or \u003ccode\u003e\u0026lt;!ENTITY xxe SYSTEM \u0026quot;http://internal-host/admin\u0026quot;\u0026gt;]\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eThe attacker delivers this crafted PDF to a target system that uses \u003ccode\u003everaPDF-validation\u003c/code\u003e to process or validate PDF files.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003everaPDF-validation\u003c/code\u003e library, specifically the \u003ccode\u003egetRichTextStringOrStreamEntryStringRepresentation()\u003c/code\u003e method in \u003ccode\u003evalidation-model/src/main/java/org/verapdf/gf/model/tools/DictionaryKeysHelper.java\u003c/code\u003e, attempts to parse the embedded XML.\u003c/li\u003e\n\u003cli\u003eDue to the \u003ccode\u003eDocumentBuilderFactory\u003c/code\u003e being instantiated with default, insecure settings (no \u003ccode\u003edisallow-doctype-decl\u003c/code\u003e, no disabling of external entities, no secure \u003ccode\u003eEntityResolver\u003c/code\u003e), the XML parser resolves the external entity.\u003c/li\u003e\n\u003cli\u003eThe content of the specified external resource (e.g., \u003ccode\u003e/etc/passwd\u003c/code\u003e or the response from \u003ccode\u003ehttp://internal-host/admin\u003c/code\u003e) is retrieved by the vulnerable veraPDF application.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003egetAllNodeText()\u003c/code\u003e method recursively concatenates all text nodes, including the expanded content of the external entity.\u003c/li\u003e\n\u003cli\u003eThe sensitive data or response from the SSRF attempt is reflected directly into the validation report or the output generated by veraPDF, allowing the attacker to exfiltrate it.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of CVE-2026-54078 allows a remote attacker to read arbitrary files from the compromised server's file system, potentially exfiltrating sensitive data such as configuration files, user credentials, or application source code. Additionally, the Server-Side Request Forgery (SSRF) capability enables the attacker to initiate requests to internal network resources, bypassing firewall rules and potentially gaining access to internal services or hosts that are not directly exposed to the internet. This could lead to further reconnaissance, lateral movement, or data exfiltration from the internal infrastructure. All current releases of the veraPDF \u003ccode\u003evalidation-model\u003c/code\u003e module are affected, meaning a wide range of systems performing PDF validation are vulnerable to this attack.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003ePatch CVE-2026-54078 immediately by updating \u003ccode\u003emaven/org.verapdf:validation-model\u003c/code\u003e and \u003ccode\u003emaven/org.verapdf:validation-model-jakarta\u003c/code\u003e to a fixed version as soon as one is available.\u003c/li\u003e\n\u003cli\u003eImplement secure XML parsing practices in applications handling untrusted XML, specifically hardening \u003ccode\u003eDocumentBuilderFactory\u003c/code\u003e configurations to disallow DOCTYPE declarations and external entity resolution.\u003c/li\u003e\n\u003cli\u003eMonitor application logs for unusual file access patterns or outbound connections initiated by the veraPDF process that could indicate successful SSRF or file exfiltration attempts related to the vulnerability described in this brief.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-07-29T15:14:37Z","date_published":"2026-07-29T15:14:37Z","id":"https://feed.craftedsignal.io/briefs/2026-07-verapdf-xxe/","summary":"An XML External Entity (XXE) injection vulnerability (CVE-2026-54078, CWE-611) in the veraPDF-validation library's `validation-model` module allows a remote attacker to read arbitrary files from the server's file system and perform Server-Side Request Forgery by submitting a crafted PDF containing a malicious rich-text entry, which is then parsed by an insecure `DocumentBuilderFactory`.","title":"veraPDF Validation XXE via Rich Text","url":"https://feed.craftedsignal.io/briefs/2026-07-verapdf-xxe/"}],"language":"en","title":"CraftedSignal Threat Feed - Validation-Model-Jakarta (\u003e= 1.25.73, \u003c= 1.30.1)","version":"https://jsonfeed.org/version/1.1"}