CVE-2026-54079: Validation model VeraPDF Validation XXE Vulnerability

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-36mm-w85j-3q2j",
  "modified" : "2026-07-29T15:08:17Z",
  "published" : "2026-07-29T15:08:17Z",
  "aliases" : [ "CVE-2026-54079" ],
  "summary" : "veraPDF Validation XXE via XFA",
  "details" : "## Summary  \n  \n**Description**\nAn XML External Entity Injection (CWE-611) vulnerability in veraPDF allows a remote attacker to read arbitrary files on the server file system and perform Server-Side Request Forgery by submitting a crafted PDF containing a malicious XFA stream. This affects all current versions of veraPDF-validation.  \n  \n## Details  \nThe vulnerability resides in veraPDF-validation `validation-model/src/main/java/org/verapdf/gf/model/impl/pd/GFPDAcroForm.java` within the `getdynamicRender()` method. This method retrieves the /XFA entry from the PDF's /AcroForm dictionary, decodes the embedded XML stream, and parses it to extract the `<dynamicRender>` element value.  \n  \nThe vulnerability stems from the use of a default-configured `DocumentBuilderFactory` to parse fully attacker-controlled XML:  \n- The factory is created via `DocumentBuilderFactory.newInstance()` with no security features enabled. disallow-doctype-decl, external-general-entities, external-parameter-entities, and FEATURE_SECURE_PROCESSING are all left at their insecure defaults.  \n- The input passed to `builder.parse()` is the decoded /XFA stream taken directly from the untrusted PDF.  \n- The text content of the `<dynamicRender>` node is returned to the validation model. Note that the shipped PDF/UA-1 rule (`dynamicRender != 'required'`) consumes this value but does not echo it into the report output, so reliable exfiltration requires the out-of-band parameter-entity technique described under Impact rather than in-band reflection.  \n  \n## Impact  \n  \nThis impacts all current releases of the veraPDF validation-model module.  \n  \nSuccessful exploitation requires only that the target validate an attacker-supplied PDF against the PDF/UA-1 profile (or via flavour auto-detection on a PDF that declares PDF/UA-1 conformance), since `getdynamicRender()` is invoked by the `dynamicRender != 'required'` rule in the bundled PDF/UA-1 profile. No additional configuration or operator action is required.  \n    \n## Proposed Patch  \n  \nHarden the `DocumentBuilderFactory` in `validation-model/src/main/java/org/verapdf/gf/model/impl/pd/GFPDAcroForm.java` per the OWASP XXE Prevention Cheat Sheet to disallow DOCTYPE outright.",
  "severity" : [ {
    "type" : "CVSS_V4",
    "score" : "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "Maven",
      "name" : "org.verapdf:validation-model"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "1.17.35"
      }, {
        "fixed" : "1.30.2"
      } ]
    } ],
    "database_specific" : {
      "last_known_affected_version_range" : "<= 1.30.1"
    }
  }, {
    "package" : {
      "ecosystem" : "Maven",
      "name" : "org.verapdf:validation-model"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "1.31.1"
      }, {
        "fixed" : "1.31.71"
      } ]
    } ],
    "database_specific" : {
      "last_known_affected_version_range" : "<= 1.31.70"
    }
  }, {
    "package" : {
      "ecosystem" : "Maven",
      "name" : "org.verapdf:validation-model-jakarta"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "1.17.35"
      }, {
        "fixed" : "1.30.2"
      } ]
    } ],
    "database_specific" : {
      "last_known_affected_version_range" : "<= 1.30.1"
    }
  }, {
    "package" : {
      "ecosystem" : "Maven",
      "name" : "org.verapdf:validation-model-jakarta"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "1.31.1"
      }, {
        "fixed" : "1.31.71"
      } ]
    } ],
    "database_specific" : {
      "last_known_affected_version_range" : "<= 1.31.70"
    }
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/veraPDF/veraPDF-validation/security/advisories/GHSA-36mm-w85j-3q2j"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/veraPDF/veraPDF-validation/pull/730"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/veraPDF/veraPDF-validation/commit/94caa46c1a594512247fbd46c808edae39469542"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/veraPDF/veraPDF-validation/commit/cacd9436d0de40b0e58cc7d2dbb06451619e61ec"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/veraPDF/veraPDF-validation"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-611" ],
    "severity" : "HIGH",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-07-29T15:08:17Z",
    "nvd_published_at" : null
  }
}