CVE-2026-54079: veraPDF Validation XXE Vulnerability

CVE-2026-54079 Overview

CVE-2026-54079 is an XML External Entity (XXE) vulnerability in veraPDF-validation, an open-source library that provides PDF/A and PDF/UA validation, feature reporting, and metadata repair. The flaw resides in the getdynamicRender() method within validation-model/src/main/java/org/verapdf/gf/model/impl/pd/GFPDAcroForm.java. A crafted PDF containing a malicious XForms Architecture (XFA) stream triggers external entity expansion during PDF/UA-1 validation. Affected releases span from version 1.17.35 up to but not including 1.30.2 and 1.31.71. The issue is classified under [CWE-611] (Improper Restriction of XML External Entity Reference).

Critical Impact
Attackers can achieve local file disclosure or trigger outbound server-side requests by supplying a malicious PDF for validation, exposing sensitive host data and enabling server-side request forgery (SSRF) pivots.

Affected Products

veraPDF-validation versions 1.17.35 through 1.30.1
veraPDF-validation versions 1.31.0 through 1.31.70
Downstream tools and pipelines embedding veraPDF for PDF/UA-1 validation

Discovery Timeline

2026-07-29 - CVE-2026-54079 published to NVD
2026-07-29 - Last updated in NVD database

Technical Details for CVE-2026-54079

Vulnerability Analysis

The vulnerability stems from insecure XML parsing during PDF/UA-1 validation of AcroForm structures. veraPDF instantiated a DocumentBuilderFactory without disabling external entity resolution or DTD processing. When the library processes a PDF containing an XFA stream, it parses embedded XML using the default, insecure configuration. A malicious XFA payload can declare external entities that reference local files or remote URLs. During parsing, the resolver dereferences those entities, injecting file contents into the parsed document or generating outbound HTTP requests from the host running veraPDF.

Because veraPDF is embedded in automated validation pipelines, document ingestion services, and archival systems, an attacker only needs to submit a crafted PDF. The parser processes the document without authentication, executing the XXE payload in the context of the validation service.

Root Cause

The root cause is direct use of javax.xml.parsers.DocumentBuilderFactory without hardening flags such as FEATURE_SECURE_PROCESSING, disallow-doctype-decl, or disabling external-general-entities and external-parameter-entities. The patch replaces the raw factory with a SecureXML helper from org.verapdf.xmp.tools, which applies safe defaults.

Attack Vector

An attacker crafts a PDF whose AcroForm contains an XFA stream with a malicious XML DOCTYPE declaration. When the target system validates the PDF against PDF/UA-1, veraPDF invokes getdynamicRender(), which parses the XFA XML. The external entity resolver reads arbitrary files (for example /etc/passwd) or issues HTTP requests to internal services, enabling SSRF against cloud metadata endpoints and internal APIs.

java

// Patch: validation-model/src/main/java/org/verapdf/gf/model/impl/pd/GFPDAcroForm.java
 import org.verapdf.model.baselayer.Object;
 import org.verapdf.model.pdlayer.PDAcroForm;
 import org.verapdf.model.pdlayer.PDFormField;
+import org.verapdf.xmp.tools.SecureXML;
 import org.w3c.dom.Document;
 import org.w3c.dom.Node;
 import org.w3c.dom.NodeList;
 import org.xml.sax.InputSource;
 
 import javax.xml.parsers.DocumentBuilder;
-import javax.xml.parsers.DocumentBuilderFactory;
 import java.util.ArrayList;
 import java.util.Collections;
 import java.util.List;
// Source: https://github.com/veraPDF/veraPDF-validation/commit/94caa46c1a594512247fbd46c808edae39469542

The patch removes the insecure DocumentBuilderFactory import and routes XML parsing through SecureXML, which disables DTDs and external entity resolution by default. A parallel change in DictionaryKeysHelper.java applies the same fix to secondary XML parsing paths.

Detection Methods for CVE-2026-54079

Indicators of Compromise

Unexpected outbound HTTP or DNS traffic originating from PDF validation workers, particularly to attacker-controlled or cloud metadata endpoints such as 169.254.169.254.
Java processes running veraPDF opening sensitive local files (for example /etc/passwd, /proc/self/environ, or private key stores) during PDF ingestion.
PDF files containing XFA streams with <!DOCTYPE declarations, external entity references (SYSTEM), or parameter entities.

Detection Strategies

Inspect ingested PDFs for XFA streams containing XML DTD declarations or SYSTEM identifiers before submitting them to veraPDF.
Correlate PDF processing events with file access and network telemetry to flag validation jobs that trigger file reads outside expected directories.
Audit application dependency manifests for veraPDF-validation versions between 1.17.35 and the fixed releases 1.30.2 or 1.31.71.

Monitoring Recommendations

Log and alert on egress traffic from PDF validation hosts to non-approved destinations.
Monitor JVM file-access syscalls on document processing servers and baseline expected read paths.
Track SBOM entries for org.verapdf:validation-model and gate builds that pin vulnerable versions.

How to Mitigate CVE-2026-54079

Immediate Actions Required

Upgrade veraPDF-validation to version 1.30.2 or 1.31.71 in all affected services and rebuild dependent artifacts.
Restrict outbound network access from PDF validation workers to only required destinations to blunt SSRF impact.
Run veraPDF under a least-privilege service account that cannot read secrets, credentials, or sensitive configuration files.

Patch Information

The fix ships in veraPDF-validation 1.30.2 and 1.31.71. The relevant commits are 94caa46 and cacd943, merged via pull request #730. See the GHSA-36mm-w85j-3q2j advisory for the full vendor statement.

Workarounds

Pre-filter incoming PDFs to reject documents containing XFA streams with DTD declarations until patching completes.
Execute veraPDF inside a sandbox or container with no outbound network access and read-only mounts.
If a custom XML parser is used alongside veraPDF, enforce FEATURE_SECURE_PROCESSING and disable external entities on all DocumentBuilderFactory instances.

bash

# Upgrade veraPDF-validation via Maven coordinates
mvn versions:use-dep-version \
  -Dincludes=org.verapdf:validation-model \
  -DdepVersion=1.31.71 \
  -DforceVersion=true

# Verify the patched version is resolved
mvn dependency:tree | grep verapdf