{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/vendors/verapdf/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["validation-model (\u003e= 1.25.73, \u003c= 1.30.1)","validation-model (\u003e= 1.31.1, \u003c= 1.31.70)","validation-model-jakarta (\u003e= 1.25.73, \u003c= 1.30.1)","validation-model-jakarta (\u003e= 1.31.1, \u003c= 1.31.70)"],"_cs_severities":["high"],"_cs_tags":["xml-external-entity-injection","xxe","server-side-request-forgery","ssrf","pdf","java"],"_cs_type":"advisory","_cs_vendors":["veraPDF"],"content_html":"\u003cp\u003eA critical XML External Entity (XXE) injection vulnerability, identified as CVE-2026-54078 (CWE-611), has been discovered in the veraPDF-validation library. This vulnerability specifically impacts the \u003ccode\u003evalidation-model\u003c/code\u003e module across all current versions of veraPDF-validation. Exploitation occurs when a remote attacker crafts a malicious PDF document that includes a specially designed rich-text entry (\u003ccode\u003e/RC\u003c/code\u003e or \u003ccode\u003e/RV\u003c/code\u003e). When this crafted PDF is processed by the vulnerable veraPDF instance, an insecurely configured \u003ccode\u003eDocumentBuilderFactory\u003c/code\u003e within the \u003ccode\u003egetRichTextStringOrStreamEntryStringRepresentation()\u003c/code\u003e method fails to disable external entity resolution or DOCTYPE declarations. This allows the attacker to read arbitrary files from the server's file system and initiate Server-Side Request Forgery (SSRF) attacks, exposing sensitive information and potentially leading to further compromise of the internal network.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAn attacker crafts a malicious PDF document containing a rich-text entry (e.g., \u003ccode\u003e/RC\u003c/code\u003e or \u003ccode\u003e/RV\u003c/code\u003e).\u003c/li\u003e\n\u003cli\u003eThe rich-text entry embeds XML data that includes an external entity declaration, such as \u003ccode\u003e\u0026lt;!DOCTYPE foo [\u0026lt;!ENTITY xxe SYSTEM \u0026quot;file:///etc/passwd\u0026quot;\u0026gt;]\u0026gt;\u003c/code\u003e or \u003ccode\u003e\u0026lt;!ENTITY xxe SYSTEM \u0026quot;http://internal-host/admin\u0026quot;\u0026gt;]\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eThe attacker delivers this crafted PDF to a target system that uses \u003ccode\u003everaPDF-validation\u003c/code\u003e to process or validate PDF files.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003everaPDF-validation\u003c/code\u003e library, specifically the \u003ccode\u003egetRichTextStringOrStreamEntryStringRepresentation()\u003c/code\u003e method in \u003ccode\u003evalidation-model/src/main/java/org/verapdf/gf/model/tools/DictionaryKeysHelper.java\u003c/code\u003e, attempts to parse the embedded XML.\u003c/li\u003e\n\u003cli\u003eDue to the \u003ccode\u003eDocumentBuilderFactory\u003c/code\u003e being instantiated with default, insecure settings (no \u003ccode\u003edisallow-doctype-decl\u003c/code\u003e, no disabling of external entities, no secure \u003ccode\u003eEntityResolver\u003c/code\u003e), the XML parser resolves the external entity.\u003c/li\u003e\n\u003cli\u003eThe content of the specified external resource (e.g., \u003ccode\u003e/etc/passwd\u003c/code\u003e or the response from \u003ccode\u003ehttp://internal-host/admin\u003c/code\u003e) is retrieved by the vulnerable veraPDF application.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003egetAllNodeText()\u003c/code\u003e method recursively concatenates all text nodes, including the expanded content of the external entity.\u003c/li\u003e\n\u003cli\u003eThe sensitive data or response from the SSRF attempt is reflected directly into the validation report or the output generated by veraPDF, allowing the attacker to exfiltrate it.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of CVE-2026-54078 allows a remote attacker to read arbitrary files from the compromised server's file system, potentially exfiltrating sensitive data such as configuration files, user credentials, or application source code. Additionally, the Server-Side Request Forgery (SSRF) capability enables the attacker to initiate requests to internal network resources, bypassing firewall rules and potentially gaining access to internal services or hosts that are not directly exposed to the internet. This could lead to further reconnaissance, lateral movement, or data exfiltration from the internal infrastructure. All current releases of the veraPDF \u003ccode\u003evalidation-model\u003c/code\u003e module are affected, meaning a wide range of systems performing PDF validation are vulnerable to this attack.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003ePatch CVE-2026-54078 immediately by updating \u003ccode\u003emaven/org.verapdf:validation-model\u003c/code\u003e and \u003ccode\u003emaven/org.verapdf:validation-model-jakarta\u003c/code\u003e to a fixed version as soon as one is available.\u003c/li\u003e\n\u003cli\u003eImplement secure XML parsing practices in applications handling untrusted XML, specifically hardening \u003ccode\u003eDocumentBuilderFactory\u003c/code\u003e configurations to disallow DOCTYPE declarations and external entity resolution.\u003c/li\u003e\n\u003cli\u003eMonitor application logs for unusual file access patterns or outbound connections initiated by the veraPDF process that could indicate successful SSRF or file exfiltration attempts related to the vulnerability described in this brief.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-07-29T15:14:37Z","date_published":"2026-07-29T15:14:37Z","id":"https://feed.craftedsignal.io/briefs/2026-07-verapdf-xxe/","summary":"An XML External Entity (XXE) injection vulnerability (CVE-2026-54078, CWE-611) in the veraPDF-validation library's `validation-model` module allows a remote attacker to read arbitrary files from the server's file system and perform Server-Side Request Forgery by submitting a crafted PDF containing a malicious rich-text entry, which is then parsed by an insecure `DocumentBuilderFactory`.","title":"veraPDF Validation XXE via Rich Text","url":"https://feed.craftedsignal.io/briefs/2026-07-verapdf-xxe/"},{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["veraPDF validation-model (\u003e= 1.17.35, \u003c= 1.30.1)","veraPDF validation-model (\u003e= 1.31.1, \u003c= 1.31.70)","veraPDF validation-model-jakarta (\u003e= 1.17.35, \u003c= 1.30.1)","veraPDF validation-model-jakarta (\u003e= 1.31.1, \u003c= 1.31.70)"],"_cs_severities":["high"],"_cs_tags":["xxe","xml-external-entity","pdf","server-side-request-forgery","vulnerability"],"_cs_type":"advisory","_cs_vendors":["veraPDF"],"content_html":"\u003cp\u003eAn XML External Entity Injection (CWE-611) vulnerability exists in veraPDF's validation-model module, affecting all current versions. Discovered and published by GHSA on July 29, 2026, this flaw allows a remote attacker to achieve arbitrary file disclosure or Server-Side Request Forgery (SSRF) by submitting a specially crafted PDF file containing a malicious XFA stream. The vulnerability resides in the \u003ccode\u003eGFPDAcroForm.java\u003c/code\u003e component, where the \u003ccode\u003egetdynamicRender()\u003c/code\u003e method insecurely parses attacker-controlled XML from the XFA entry using a \u003ccode\u003eDocumentBuilderFactory\u003c/code\u003e with default, unsafe settings. This lack of security features, such as \u003ccode\u003edisallow-doctype-decl\u003c/code\u003e and \u003ccode\u003eexternal-general-entities\u003c/code\u003e being enabled, allows the XML parser to process external entities specified by the attacker. Exploitation occurs when the target validates the malicious PDF, particularly against the PDF/UA-1 profile, which triggers the vulnerable parsing logic. This bypasses typical validation checks and poses a significant risk to server integrity and data confidentiality, as it enables unauthorized access to local files and internal network resources, with exfiltration typically occurring out-of-band.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAn attacker crafts a malicious PDF document embedded with an XFA stream containing an XML External Entity (XXE) payload designed for file disclosure or SSRF.\u003c/li\u003e\n\u003cli\u003eThe attacker submits or delivers this malicious PDF to a target system running a vulnerable version of veraPDF.\u003c/li\u003e\n\u003cli\u003eThe target veraPDF instance begins validating the PDF, specifically against the PDF/UA-1 profile, which invokes the \u003ccode\u003egetdynamicRender()\u003c/code\u003e method in \u003ccode\u003eGFPDAcroForm.java\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003egetdynamicRender()\u003c/code\u003e method retrieves and decodes the embedded XML stream from the PDF's /XFA entry.\u003c/li\u003e\n\u003cli\u003eA \u003ccode\u003eDocumentBuilderFactory.newInstance()\u003c/code\u003e is used to parse the untrusted XML without security features enabled (e.g., \u003ccode\u003edisallow-doctype-decl\u003c/code\u003e or \u003ccode\u003eexternal-general-entities\u003c/code\u003e).\u003c/li\u003e\n\u003cli\u003eThe XML parser processes the malicious external entities within the XFA stream, triggering either arbitrary file reading from the veraPDF server's file system or initiating a Server-Side Request Forgery (SSRF) connection.\u003c/li\u003e\n\u003cli\u003eIf the XXE is configured for file reading, the contents of the target file are either processed internally or, more commonly, exfiltrated out-of-band via a parameter entity to an attacker-controlled server.\u003c/li\u003e\n\u003cli\u003eThe attacker gains unauthorized access to sensitive local files or uses the SSRF capability to interact with internal network services or bypass network restrictions.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThis vulnerability (CVE-2026-54079) impacts all current releases of the veraPDF \u003ccode\u003evalidation-model\u003c/code\u003e module, including versions 1.17.35 through 1.30.1 and 1.31.1 through 1.31.70 for both \u003ccode\u003evalidation-model\u003c/code\u003e and \u003ccode\u003evalidation-model-jakarta\u003c/code\u003e. Successful exploitation allows a remote attacker to achieve arbitrary file disclosure, enabling the theft of sensitive information (e.g., configuration files, credentials), or to perform Server-Side Request Forgery, which can lead to internal network reconnaissance, access to internal services, or further compromise of the network. Exploitation is silent and does not require additional configuration or user interaction beyond the standard validation of a malicious PDF against the PDF/UA-1 profile.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003ePatch CVE-2026-54079 immediately by updating veraPDF \u003ccode\u003evalidation-model\u003c/code\u003e and \u003ccode\u003evalidation-model-jakarta\u003c/code\u003e to versions beyond the affected ranges (e.g., to versions patched against this XXE vulnerability) to prevent arbitrary file disclosure and SSRF.\u003c/li\u003e\n\u003cli\u003eRestrict inbound PDF submissions to trusted sources or implement strict content validation and sanitization for all untrusted PDF inputs.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-07-29T15:10:34Z","date_published":"2026-07-29T15:10:34Z","id":"https://feed.craftedsignal.io/briefs/2026-07-verapdf-xxe-vulnerability/","summary":"A critical XML External Entity Injection (XXE) vulnerability, CVE-2026-54079, in veraPDF's validation-model module allows a remote attacker to read arbitrary files on the server file system or perform Server-Side Request Forgery (SSRF) by submitting a crafted PDF containing a malicious XFA stream, due to insecure XML parsing defaults.","title":"veraPDF Validation Module XML External Entity Injection Vulnerability (CVE-2026-54079)","url":"https://feed.craftedsignal.io/briefs/2026-07-verapdf-xxe-vulnerability/"}],"language":"en","title":"CraftedSignal Threat Feed - VeraPDF","version":"https://jsonfeed.org/version/1.1"}