CVE-2026-54082

veraPDF validation model is an implementation of the veraPDF validation model. From 1.25.73 until 1.30.2 and 1.31.71, veraPDF-validation contains an XML External Entity vulnerability in PDFAValidator.validate(...) and GFPDAcroForm.getdynamicRender(), where default DocumentBuilderFactory parsing of rich-text annotation or form-field values and XFA configurations in untrusted PDFs can allow local file disclosure and outbound network requests. This issue is fixed in versions 1.30.2 and 1.31.71.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 3.9 / Impact : 2.5

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/veraPDF/veraPDF-validation/commit/94caa46c1a594512247fbd46c808edae39469542
https://github.com/veraPDF/veraPDF-validation/commit/cacd9436d0de40b0e58cc7d2dbb06451619e61ec
https://github.com/veraPDF/veraPDF-validation/pull/730
https://github.com/veraPDF/veraPDF-validation/security/advisories/GHSA-cg9x-g3gm-h5h6

Configurations

No configuration.

History

23 Oct 2026, 23:10

Type	Values Removed	Values Added
Summary		(es) El modelo de validación de veraPDF es una implementación del modelo de validación de veraPDF. Desde la 1.25.73 hasta la 1.30.2 y la 1.31.71, veraPDF-validation contiene una vulnerabilidad de entidad externa XML en PDFAValidator.validate(...) y GFPDAcroForm.getdynamicRender(), donde el análisis predeterminado de DocumentBuilderFactory de anotaciones de texto enriquecido o valores de campos de formulario y configuraciones XFA en PDF no confiables puede permitir la divulgación de archivos locales y solicitudes de red salientes. Este problema está solucionado en las versiones 1.30.2 y 1.31.71.

Information

Published : 2026-07-29 16:17

Updated : 2026-10-23 23:10

NVD link : CVE-2026-54082

Mitre link : CVE-2026-54082

CVE.ORG link : CVE-2026-54082

JSON object : View

Products Affected

No product.

CWE

CWE-611

Improper Restriction of XML External Entity Reference

{"id": "CVE-2026-54082", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-54082", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-30T13:51:33.276090Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.5, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "veraPDF", "product": "veraPDF-validation", "versions": [{"status": "affected", "version": ">= 1.17.35, < 1.30.2"}, {"status": "affected", "version": ">= 1.31.1, < 1.31.71"}]}]}], "published": "2026-07-29T16:17:53.630", "references": [{"url": "https://github.com/veraPDF/veraPDF-validation/commit/94caa46c1a594512247fbd46c808edae39469542", "source": "security-advisories@github.com"}, {"url": "https://github.com/veraPDF/veraPDF-validation/commit/cacd9436d0de40b0e58cc7d2dbb06451619e61ec", "source": "security-advisories@github.com"}, {"url": "https://github.com/veraPDF/veraPDF-validation/pull/730", "source": "security-advisories@github.com"}, {"url": "https://github.com/veraPDF/veraPDF-validation/security/advisories/GHSA-cg9x-g3gm-h5h6", "source": "security-advisories@github.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-611"}]}], "descriptions": [{"lang": "en", "value": "veraPDF validation model is an implementation of the veraPDF validation model. From 1.25.73 until 1.30.2 and 1.31.71, veraPDF-validation contains an XML External Entity vulnerability in PDFAValidator.validate(...) and GFPDAcroForm.getdynamicRender(), where default DocumentBuilderFactory parsing of rich-text annotation or form-field values and XFA configurations in untrusted PDFs can allow local file disclosure and outbound network requests. This issue is fixed in versions 1.30.2 and 1.31.71."}, {"lang": "es", "value": "El modelo de validaci\u00f3n de veraPDF es una implementaci\u00f3n del modelo de validaci\u00f3n de veraPDF. Desde la 1.25.73 hasta la 1.30.2 y la 1.31.71, veraPDF-validation contiene una vulnerabilidad de entidad externa XML en PDFAValidator.validate(...) y GFPDAcroForm.getdynamicRender(), donde el an\u00e1lisis predeterminado de DocumentBuilderFactory de anotaciones de texto enriquecido o valores de campos de formulario y configuraciones XFA en PDF no confiables puede permitir la divulgaci\u00f3n de archivos locales y solicitudes de red salientes. Este problema est\u00e1 solucionado en las versiones 1.30.2 y 1.31.71."}], "lastModified": "2026-10-23T23:10:00.157", "sourceIdentifier": "security-advisories@github.com"}