{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/products/verapdf-validation-model-jakarta--1.31.1--1.31.70/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["veraPDF validation-model (\u003e= 1.17.35, \u003c= 1.30.1)","veraPDF validation-model (\u003e= 1.31.1, \u003c= 1.31.70)","veraPDF validation-model-jakarta (\u003e= 1.17.35, \u003c= 1.30.1)","veraPDF validation-model-jakarta (\u003e= 1.31.1, \u003c= 1.31.70)"],"_cs_severities":["high"],"_cs_tags":["xxe","xml-external-entity","pdf","server-side-request-forgery","vulnerability"],"_cs_type":"advisory","_cs_vendors":["veraPDF"],"content_html":"\u003cp\u003eAn XML External Entity Injection (CWE-611) vulnerability exists in veraPDF's validation-model module, affecting all current versions. Discovered and published by GHSA on July 29, 2026, this flaw allows a remote attacker to achieve arbitrary file disclosure or Server-Side Request Forgery (SSRF) by submitting a specially crafted PDF file containing a malicious XFA stream. The vulnerability resides in the \u003ccode\u003eGFPDAcroForm.java\u003c/code\u003e component, where the \u003ccode\u003egetdynamicRender()\u003c/code\u003e method insecurely parses attacker-controlled XML from the XFA entry using a \u003ccode\u003eDocumentBuilderFactory\u003c/code\u003e with default, unsafe settings. This lack of security features, such as \u003ccode\u003edisallow-doctype-decl\u003c/code\u003e and \u003ccode\u003eexternal-general-entities\u003c/code\u003e being enabled, allows the XML parser to process external entities specified by the attacker. Exploitation occurs when the target validates the malicious PDF, particularly against the PDF/UA-1 profile, which triggers the vulnerable parsing logic. This bypasses typical validation checks and poses a significant risk to server integrity and data confidentiality, as it enables unauthorized access to local files and internal network resources, with exfiltration typically occurring out-of-band.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAn attacker crafts a malicious PDF document embedded with an XFA stream containing an XML External Entity (XXE) payload designed for file disclosure or SSRF.\u003c/li\u003e\n\u003cli\u003eThe attacker submits or delivers this malicious PDF to a target system running a vulnerable version of veraPDF.\u003c/li\u003e\n\u003cli\u003eThe target veraPDF instance begins validating the PDF, specifically against the PDF/UA-1 profile, which invokes the \u003ccode\u003egetdynamicRender()\u003c/code\u003e method in \u003ccode\u003eGFPDAcroForm.java\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003egetdynamicRender()\u003c/code\u003e method retrieves and decodes the embedded XML stream from the PDF's /XFA entry.\u003c/li\u003e\n\u003cli\u003eA \u003ccode\u003eDocumentBuilderFactory.newInstance()\u003c/code\u003e is used to parse the untrusted XML without security features enabled (e.g., \u003ccode\u003edisallow-doctype-decl\u003c/code\u003e or \u003ccode\u003eexternal-general-entities\u003c/code\u003e).\u003c/li\u003e\n\u003cli\u003eThe XML parser processes the malicious external entities within the XFA stream, triggering either arbitrary file reading from the veraPDF server's file system or initiating a Server-Side Request Forgery (SSRF) connection.\u003c/li\u003e\n\u003cli\u003eIf the XXE is configured for file reading, the contents of the target file are either processed internally or, more commonly, exfiltrated out-of-band via a parameter entity to an attacker-controlled server.\u003c/li\u003e\n\u003cli\u003eThe attacker gains unauthorized access to sensitive local files or uses the SSRF capability to interact with internal network services or bypass network restrictions.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThis vulnerability (CVE-2026-54079) impacts all current releases of the veraPDF \u003ccode\u003evalidation-model\u003c/code\u003e module, including versions 1.17.35 through 1.30.1 and 1.31.1 through 1.31.70 for both \u003ccode\u003evalidation-model\u003c/code\u003e and \u003ccode\u003evalidation-model-jakarta\u003c/code\u003e. Successful exploitation allows a remote attacker to achieve arbitrary file disclosure, enabling the theft of sensitive information (e.g., configuration files, credentials), or to perform Server-Side Request Forgery, which can lead to internal network reconnaissance, access to internal services, or further compromise of the network. Exploitation is silent and does not require additional configuration or user interaction beyond the standard validation of a malicious PDF against the PDF/UA-1 profile.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003ePatch CVE-2026-54079 immediately by updating veraPDF \u003ccode\u003evalidation-model\u003c/code\u003e and \u003ccode\u003evalidation-model-jakarta\u003c/code\u003e to versions beyond the affected ranges (e.g., to versions patched against this XXE vulnerability) to prevent arbitrary file disclosure and SSRF.\u003c/li\u003e\n\u003cli\u003eRestrict inbound PDF submissions to trusted sources or implement strict content validation and sanitization for all untrusted PDF inputs.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-07-29T15:10:34Z","date_published":"2026-07-29T15:10:34Z","id":"https://feed.craftedsignal.io/briefs/2026-07-verapdf-xxe-vulnerability/","summary":"A critical XML External Entity Injection (XXE) vulnerability, CVE-2026-54079, in veraPDF's validation-model module allows a remote attacker to read arbitrary files on the server file system or perform Server-Side Request Forgery (SSRF) by submitting a crafted PDF containing a malicious XFA stream, due to insecure XML parsing defaults.","title":"veraPDF Validation Module XML External Entity Injection Vulnerability (CVE-2026-54079)","url":"https://feed.craftedsignal.io/briefs/2026-07-verapdf-xxe-vulnerability/"}],"language":"en","title":"CraftedSignal Threat Feed - VeraPDF Validation-Model-Jakarta (\u003e= 1.31.1, \u003c= 1.31.70)","version":"https://jsonfeed.org/version/1.1"}