Skip to content
Fencer Intel
medium 6.5

CVE-2026-54082 json

veraPDF-validatio: Use of Default `DocumentBuilderFactory` leads to XXE When Processing Untrusted PDFs

published 3mo ago modified 19d ago also GHSA-cg9x-g3gm-h5h6 , EUVD-2026-50370

cvss
6.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.4%
EPSS 0.4% chance of exploitation in 30 days, percentile 34%
public exploits
0
none known

Summary

veraPDF validation model is an implementation of the veraPDF validation model. From 1.25.73 until 1.30.2 and 1.31.71, veraPDF-validation contains an XML External Entity vulnerability in PDFAValidator.validate(...) and GFPDAcroForm.getdynamicRender(), where default DocumentBuilderFactory parsing of rich-text annotation or form-field values and XFA configurations in untrusted PDFs can allow local file disclosure and outbound network requests. This issue is fixed in versions 1.30.2 and 1.31.71.

Patch / fix

  • maven org.verapdf:validation-model 1.30.2, 1.31.71
  • maven org.verapdf:validation-model-jakarta 1.30.2, 1.31.71

Is CVE-2026-54082 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
partial
Assessed
3mo ago

Exploit prediction

0.40% chance of exploitation in the next 30 days, higher than 34% of all scored CVEs (FIRST EPSS, 2026-11-11).

CVSS scores

assigned by version score vector
CNA 3.1 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
GitHub 3.1 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Affected packages

ecosystem package affected fixed in
maven org.verapdf:validation-model
>=1.17.35, <1.30.2
>=1.31.1, <1.31.71
1.30.2
1.31.71
maven org.verapdf:validation-model-jakarta
>=1.17.35, <1.30.2
>=1.31.1, <1.31.71
1.30.2
1.31.71

Affected products

  • veraPDF veraPDF-validation

Classification

Weakness
  • CWE-611 Improper Restriction of XML External Entity Reference

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.