CVE-2026-54082: veraPDF Validation Model XXE Vulnerability

CVE-2026-54082 Overview

CVE-2026-54082 is an XML External Entity (XXE) vulnerability in veraPDF-validation, an open-source implementation of the veraPDF PDF/A validation model. The flaw exists in PDFAValidator.validate(...) and GFPDAcroForm.getdynamicRender(), where the default DocumentBuilderFactory parses rich-text annotation values, form-field values, and XFA configurations from untrusted PDFs without disabling external entity resolution. An attacker who supplies a crafted PDF can trigger local file disclosure and outbound network requests from the host running validation. Affected releases span versions 1.25.73 through 1.30.1 and up to 1.31.70. Fixed versions are 1.30.2 and 1.31.71.

Critical Impact
A crafted PDF processed by veraPDF-validation can read local files and initiate server-side network requests via XML external entity resolution.

Affected Products

veraPDF-validation from 1.25.73 up to (but not including) 1.30.2
veraPDF-validation 1.31.x prior to 1.31.71
Applications embedding veraPDF-validation for PDF/A conformance checking

Discovery Timeline

2026-07-29 - CVE-2026-54082 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-54082

Vulnerability Analysis

The vulnerability is classified as an XML External Entity (XXE) issue [CWE-611]. veraPDF-validation invokes Java's javax.xml.parsers.DocumentBuilderFactory with its default configuration to parse XML fragments embedded inside PDF documents. Default DocumentBuilderFactory instances resolve external entities and DTDs, which means a <!ENTITY> declaration referencing file:// or http:// URIs is followed by the parser during document build. Two code paths reach this parser: rich-text annotation and form-field value parsing within GFPDAcroForm, and XFA configuration parsing during PDF/A validation. Because veraPDF is commonly deployed as a batch validator across untrusted document inputs, the parser is reachable without authentication or user interaction.

Root Cause

The root cause is missing hardening on the XML parser factory. DocumentBuilderFactory.newInstance() returns a factory that, by default, permits DTD processing and external entity resolution. The patched code replaces direct factory use with a hardened helper, org.verapdf.xmp.tools.SecureXML, that configures the parser to reject external entities and DTDs before building documents.

Attack Vector

An attacker delivers a PDF containing a crafted XFA form or rich-text annotation whose XML payload declares an external entity. When veraPDF-validation parses the document, the entity resolves against the host filesystem or an attacker-controlled URL, leaking file contents into the parsed XML tree or generating outbound HTTP requests usable for internal reconnaissance.

java

// Patch excerpt: validation-model/src/main/java/org/verapdf/gf/model/impl/pd/GFPDAcroForm.java
 import org.verapdf.model.baselayer.Object;
 import org.verapdf.model.pdlayer.PDAcroForm;
 import org.verapdf.model.pdlayer.PDFormField;
+import org.verapdf.xmp.tools.SecureXML;
 import org.w3c.dom.Document;
 import org.w3c.dom.Node;
 import org.w3c.dom.NodeList;
 import org.xml.sax.InputSource;

 import javax.xml.parsers.DocumentBuilder;
-import javax.xml.parsers.DocumentBuilderFactory;
 import java.util.ArrayList;
 import java.util.Collections;
 import java.util.List;
// Source: https://github.com/veraPDF/veraPDF-validation/commit/94caa46c1a594512247fbd46c808edae39469542

Detection Methods for CVE-2026-54082

Indicators of Compromise

PDF files containing <!DOCTYPE declarations or <!ENTITY references inside XFA streams or rich-text annotations.
Unexpected outbound DNS or HTTP requests from hosts running veraPDF batch jobs, particularly to external domains referenced in submitted PDFs.
Java process reads of sensitive files (for example /etc/passwd, application configuration files) correlated with veraPDF validation runs.

Detection Strategies

Inventory Java applications and pipelines that bundle verapdf-validation jars and confirm versions against the fixed releases 1.30.2 and 1.31.71.
Statically scan submitted PDFs for XML fragments containing DOCTYPE or ENTITY tokens before validation.
Enable JVM-level logging or a Java agent to record DocumentBuilder external entity resolution attempts during validation runs.

Monitoring Recommendations

Monitor egress traffic from validation workers and alert on connections to domains not on an allowlist.
Log file access by the veraPDF process user and flag reads outside its working directory.
Track dependency updates for verapdf-validation in software composition analysis tooling.

How to Mitigate CVE-2026-54082

Immediate Actions Required

Upgrade verapdf-validation to 1.30.2 or 1.31.71 across all environments that process untrusted PDFs.
Isolate PDF validation workers on network segments without access to internal services or sensitive file shares until patched.
Audit dependency manifests (pom.xml, build.gradle) for pinned vulnerable versions and rebuild affected artifacts.

Patch Information

The fix ships in veraPDF-validation 1.30.2 and 1.31.71. Both commits replace direct DocumentBuilderFactory usage with org.verapdf.xmp.tools.SecureXML, which disables DTDs and external entity resolution before parsing. See the GitHub Security Advisory GHSA-cg9x-g3gm-h5h6, pull request #730, and the fix commits 94caa46 and cacd943.

Workarounds

Pre-filter incoming PDFs and reject any containing DOCTYPE or ENTITY declarations within embedded XML streams.
Run veraPDF validation in a sandboxed container with no outbound network access and read-only mounts limited to the input directory.
If forking veraPDF, configure DocumentBuilderFactory with FEATURE_SECURE_PROCESSING enabled and disallow-doctype-decl set to true.

bash

# Maven dependency update to the patched release
mvn versions:set-property -Dproperty=verapdf.version -DnewVersion=1.30.2
mvn -U clean verify