CVE-2026-54078: veraPDF Validation Model XXE Vulnerability

CVE-2026-54078 Overview

CVE-2026-54078 is an XML External Entity (XXE) vulnerability in veraPDF-validation, an implementation of the veraPDF validation model used to verify PDF/A and PDF/UA conformance. The flaw exists in validation-model/src/main/java/org/verapdf/gf/model/tools/DictionaryKeysHelper.java within the getRichTextStringOrStreamEntryStringRepresentation() method. A crafted PDF containing a malicious rich-text /RC or /RV entry can trigger external entity expansion. This behavior reflects local file contents into the resulting validation report, exposing sensitive data to any actor who submits PDFs for validation. Affected versions run from 1.25.73 up to 1.30.2 and 1.31.71. The issue maps to CWE-611: Improper Restriction of XML External Entity Reference.

Critical Impact
Attackers can exfiltrate local files from systems running veraPDF-validation by submitting a crafted PDF, with the stolen contents surfaced directly in the validation report.

Affected Products

veraPDF-validation versions 1.25.73 through releases prior to 1.30.2
veraPDF-validation versions prior to 1.31.71
Applications and PDF/A validation pipelines embedding the affected validation-model component

Discovery Timeline

2026-07-29 - CVE-2026-54078 published to NVD
2026-07-29 - Last updated in NVD database

Technical Details for CVE-2026-54078

Vulnerability Analysis

The vulnerability resides in how veraPDF-validation parses rich-text form entries embedded in PDF documents. When a PDF form field contains an /RC (rich-text contents) or /RV (rich-text value) entry, getRichTextStringOrStreamEntryStringRepresentation() in DictionaryKeysHelper.java passes the XML-formatted rich-text data to a DocumentBuilder created from a default DocumentBuilderFactory. The factory is not hardened against external entity references. An attacker can therefore embed a DOCTYPE declaration and an external entity that references a local file path or a network resource. When the validator processes the PDF, the XML parser resolves the entity and inlines the referenced content into the parsed document, which is then reflected into the validation report.

Root Cause

The root cause is the use of an unhardened javax.xml.parsers.DocumentBuilderFactory without disabling external entity resolution, DTD processing, or setting the XMLConstants.FEATURE_SECURE_PROCESSING flag. This omission allows XML input to reference and dereference external entities during parsing.

Attack Vector

Exploitation requires no authentication or user interaction. An attacker submits a PDF whose AcroForm field contains a rich-text /RC or /RV payload with a malicious DOCTYPE. Any pipeline that validates untrusted PDFs, such as document ingestion, archival, or compliance workflows, will parse the payload and disclose file contents through the validation output.

java

// Patch: validation-model/src/main/java/org/verapdf/gf/model/tools/DictionaryKeysHelper.java
 */
package org.verapdf.gf.model.tools;

+import org.verapdf.xmp.tools.SecureXML;
 import org.xml.sax.InputSource;
 import org.verapdf.as.ASAtom;
 import org.verapdf.cos.*;

Source: veraPDF-validation commit 94caa46

java

// Patch: validation-model/src/main/java/org/verapdf/gf/model/impl/pd/GFPDAcroForm.java
 import org.verapdf.model.baselayer.Object;
 import org.verapdf.model.pdlayer.PDAcroForm;
 import org.verapdf.model.pdlayer.PDFormField;
+import org.verapdf.xmp.tools.SecureXML;
 import org.w3c.dom.Document;
 import org.w3c.dom.Node;
 import org.w3c.dom.NodeList;
 import org.xml.sax.InputSource;

 import javax.xml.parsers.DocumentBuilder;
-import javax.xml.parsers.DocumentBuilderFactory;
 import java.util.ArrayList;
 import java.util.Collections;
 import java.util.List;

Source: veraPDF-validation commit cacd943. The fix replaces the raw DocumentBuilderFactory with a SecureXML helper that disables external entities.

Detection Methods for CVE-2026-54078

Indicators of Compromise

PDF files containing AcroForm fields with /RC or /RV entries that include a <!DOCTYPE ... [ <!ENTITY ... SYSTEM "..."> ]> declaration.
Validation reports produced by veraPDF that contain unexpected local file paths, /etc/passwd content fragments, or internal configuration data.
Outbound network connections from the veraPDF process to attacker-controlled hosts referenced in XML entity URIs.

Detection Strategies

Scan inbound PDFs for the byte pattern <!DOCTYPE and SYSTEM within rich-text stream objects before submission to validators.
Inspect veraPDF output reports for content that does not correspond to legitimate PDF field values, especially filesystem-like strings.
Enable JVM-level XML parsing logs on validation hosts to record entity resolution attempts.

Monitoring Recommendations

Baseline outbound traffic from PDF validation servers and alert on connections initiated by the Java process to non-approved destinations.
Track invocations of DocumentBuilder.parse() on the veraPDF process using runtime application self-protection tooling.
Monitor validation queue error rates and unusual file access by the veraPDF service account.

How to Mitigate CVE-2026-54078

Immediate Actions Required

Upgrade veraPDF-validation to version 1.30.2 or 1.31.71 immediately in every service that ingests untrusted PDFs.
Isolate validation workers on network segments that cannot reach internal HTTP endpoints or sensitive filesystems.
Rotate any secrets that may have been readable by the veraPDF service account during the exposure window.
Audit archived validation reports for reflected file contents that indicate prior exploitation.

Patch Information

The fix is delivered in veraPDF-validation 1.30.2 and 1.31.71. Both patches replace the default DocumentBuilderFactory with the hardened org.verapdf.xmp.tools.SecureXML utility in DictionaryKeysHelper.java and GFPDAcroForm.java. Details are available in the GitHub Security Advisory GHSA-3jh7-wm29-q568 and Pull Request #730.

Workarounds

Run veraPDF-validation with a JVM system property that disables DTD loading: -Djavax.xml.accessExternalDTD="" and -Djavax.xml.accessExternalSchema="".
Strip AcroForm /RC and /RV entries from PDFs before submitting them to the validator using a pre-processing filter.
Deny outbound network egress from the validator host to prevent out-of-band data exfiltration through XML entities.

bash

# JVM hardening for veraPDF-validation processes
java \
  -Djavax.xml.accessExternalDTD="" \
  -Djavax.xml.accessExternalSchema="" \
  -Djdk.xml.entityExpansionLimit=0 \
  -jar verapdf-validation.jar --format xml input.pdf