https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 30 Sep 2026 07:05:09 +0000 https://vulnerability.circl.lu/vuln/fkie_cve-2026-54079 <p>veraPDF validation provides PDF/A and PDF/UA validation, feature reporting, and metadata repair. From 1.17.35 until 1.30.2 and 1.31.71, veraPDF-validation contains an XML External Entity (XXE) vulnerability in validation-model/src/main/java/org/verapdf/gf/model/impl/pd/GFPDAcroForm.java in the getdynamicRender() method, where a crafted PDF containing a malicious XFA stream can cause external entity expansion during PDF/UA-1 validation and allow local file disclosure or outbound server-side requests. This issue is fixed in versions 1.30.2 and 1.31.71.</p> <p>veraPDF validation provides PDF/A and PDF/UA validation, feature reporting, and metadata repair. From 1.17.35 until 1.30.2 and 1.31.71, veraPDF-validation contains an XML External Entity (XXE) vulnerability in validation-model/src/main/java/org/verapdf/gf/model/impl/pd/GFPDAcroForm.java in the getdynamicRender() method, where a crafted PDF containing a malicious XFA stream can cause external entity expansion during PDF/UA-1 validation and allow local file disclosure or outbound server-side requests. This issue is fixed in versions 1.30.2 and 1.31.71.</p> https://vulnerability.circl.lu/vuln/fkie_cve-2026-54079 https://vulnerability.circl.lu/vuln/ghsa-36mm-w85j-3q2j <p><strong>Affected:</strong> Maven: org.verapdf:validation-model, Maven: org.verapdf:validation-model-jakarta</p> <p>## Summary **Description** An XML External Entity Injection (CWE-611) vulnerability in veraPDF allows a remote attacker to read arbitrary files on the server file system and perform Server-Side Request Forgery by submitting a crafted PDF containing a malicious XFA stream. This affects all current versions of veraPDF-validation. ## Details The vulnerability resides in veraPDF-validation `validation-model/src/main/java/org/verapdf/gf/model/impl/pd/GFPDAcroForm.java` within the `getdynamicRender()` method. This method retrieves the /XFA entry from the PDF&#39;s /AcroForm dictionary, decodes the embedded XML stream, and parses it to extract the `&lt;dynamicRender&gt;` element value. The vulnerability stems from the use of a default-configured `DocumentBuilderFactory` to parse fully attacker-controlled XML: - The factory is created via `DocumentBuilderFactory.newInstance()` with no security features enabled. disallow-doctype-decl, external-general-entities, external-parameter-entities, and FEATURE_SECURE_PROCESSING are all left at their insecure defaults. - The input passed to `builder.parse()` is the decoded /XFA stream taken directly from the untrusted PDF. - The text content of the `&lt;dynamicRender&gt;` node is returned to the validation model. Note that the shipped PDF/UA-1 rule (`dynamicRender != &#39;required&#39;`) consumes this value but does not echo it into the report output, so reliable exfiltration requires the out-of-band parameter-entity technique described under I…</p> <p><strong>Affected:</strong> Maven: org.verapdf:validation-model, Maven: org.verapdf:validation-model-jakarta</p> <p>## Summary **Description** An XML External Entity Injection (CWE-611) vulnerability in veraPDF allows a remote attacker to read arbitrary files on the server file system and perform Server-Side Request Forgery by submitting a crafted PDF containing a malicious XFA stream. This affects all current versions of veraPDF-validation. ## Details The vulnerability resides in veraPDF-validation `validation-model/src/main/java/org/verapdf/gf/model/impl/pd/GFPDAcroForm.java` within the `getdynamicRender()` method. This method retrieves the /XFA entry from the PDF&#39;s /AcroForm dictionary, decodes the embedded XML stream, and parses it to extract the `&lt;dynamicRender&gt;` element value. The vulnerability stems from the use of a default-configured `DocumentBuilderFactory` to parse fully attacker-controlled XML: - The factory is created via `DocumentBuilderFactory.newInstance()` with no security features enabled. disallow-doctype-decl, external-general-entities, external-parameter-entities, and FEATURE_SECURE_PROCESSING are all left at their insecure defaults. - The input passed to `builder.parse()` is the decoded /XFA stream taken directly from the untrusted PDF. - The text content of the `&lt;dynamicRender&gt;` node is returned to the validation model. Note that the shipped PDF/UA-1 rule (`dynamicRender != &#39;required&#39;`) consumes this value but does not echo it into the report output, so reliable exfiltration requires the out-of-band parameter-entity technique described under I…</p> https://vulnerability.circl.lu/vuln/ghsa-36mm-w85j-3q2j