Verapdf Validation
Approved changes feed: RSS · Atom
cpe:2.3:a:verapdf:verapdf-validation:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Verapdf (2f4cdf0c-e25b-5fa7-b352-89e06acff9f3) |
|---|---|
| Product | Verapdf Validation (7860d02d-8b0d-58af-93b9-59ccf4d20c0f) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from gcve-enriched-dumps CVE data
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-54082 |
vulnerable | 2026-09-16 04:33:28.761479 |
veraPDF-validatio: Use of Default `DocumentBuilderFactory` leads to XXE When Processing Untrusted PDFs
MEDIUM (6.5)
veraPDF validation model is an implementation of the veraPDF validation model. From 1.25.73 until 1.30.2 and 1.31.71, veraPDF-validation contains an XML External Entity vulnerability in PDFAValidator.validate(...) and GFPDAcroForm.getdynamicRender(), where default DocumentBuilderFactory parsing of rich-text annotation or form-field values and XFA configurations in untrusted PDFs can allow local file disclosure and outbound network requests. This issue is fixed in versions 1.30.2 and 1.31.71.
Published: 2026-07-29T15:14:19.998Z
Updated: 2026-07-30T13:52:07.526Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-54078 |
vulnerable | 2026-09-16 04:33:28.391744 |
veraPDF Validation XXE via Rich Text
veraPDF validation model is an implementation of the veraPDF validation model. From 1.25.73 until 1.30.2 and 1.31.71, veraPDF-validation contains an XML External Entity (XXE) vulnerability in validation-model/src/main/java/org/verapdf/gf/model/tools/DictionaryKeysHelper.java in getRichTextStringOrStreamEntryStringRepresentation(), where a crafted PDF containing a malicious rich-text /RC or /RV entry can cause external entity expansion and reflect local file contents into the validation report. This issue is fixed in versions 1.30.2 and 1.31.71.
Published: 2026-07-29T15:11:05.239Z
Updated: 2026-07-29T18:02:18.227Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-54079 |
vulnerable | 2026-09-16 04:33:28.036413 |
veraPDF Validation XXE via XFA
veraPDF validation provides PDF/A and PDF/UA validation, feature reporting, and metadata repair. From 1.17.35 until 1.30.2 and 1.31.71, veraPDF-validation contains an XML External Entity (XXE) vulnerability in validation-model/src/main/java/org/verapdf/gf/model/impl/pd/GFPDAcroForm.java in the getdynamicRender() method, where a crafted PDF containing a malicious XFA stream can cause external entity expansion during PDF/UA-1 validation and allow local file disclosure or outbound server-side requests. This issue is fixed in versions 1.30.2 and 1.31.71.
Published: 2026-07-29T15:07:23.558Z
Updated: 2026-07-29T15:44:57.528Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.