highCVE-2026-54078Jul 29, 2026

CVE-2026-54078: veraPDF validation-model XXE via Rich Text

Rohit Hatagale
AI Security Researcher, SecureLayer7

Submitting a PDF with a crafted rich-text annotation field causes veraPDF to parse attacker-controlled XML with no XXE protections, letting a remote attacker read arbitrary server files or trigger…

Packageorg.verapdf:validation-model
Ecosystemmaven
Affected>= 1.25.73, <= 1.30.1
Fixed in1.30.2
CVE-2026-54078: veraPDF validation-model XXE via Rich Text

The problem

The getRichTextStringOrStreamEntryStringRepresentation() method in DictionaryKeysHelper.java parses the XHTML body of a PDF /RC or /RV dictionary entry using a bare DocumentBuilderFactory with all defaults. No disallow-doctype-decl, no entity disabling, no FEATURE_SECURE_PROCESSING.

After parsing, getAllNodeText() recursively collects every text node and returns it as a model property. That means the expanded value of any external entity lands directly in the validation report, giving an attacker a straightforward read-file or SSRF primitive requiring only that the server validates a PDF.

Proof of concept

A working proof-of-concept for CVE-2026-54078 in org.verapdf:validation-model, with the exact payload below.

text
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE foo [
  <!ENTITY xxe SYSTEM "file:///etc/passwd">
]>
<body xmlns="http://www.w3.org/1999/xhtml">
  <p>&xxe;</p>
</body>

The DocumentBuilderFactory was instantiated with no hardening flags, so the Xerces/JAXP parser resolves <!DOCTYPE> and <!ENTITY SYSTEM> declarations by default. The &xxe; reference in the XHTML body is expanded at parse time, and getAllNodeText() then concatenates the result into the returned string, which appears in the veraPDF validation report.

The 1.30.2 patch hardened DocumentBuilderFactory per the OWASP XXE Prevention Cheat Sheet, setting http://apache.org/xml/features/disallow-doctype-decl to true, which causes the parser to throw before any entity resolution can occur. CWE-611 (Improper Restriction of XML External Entity Reference).

The fix

Upgrade org.verapdf:validation-model to 1.30.2 or later. The fix sets disallow-doctype-decl on the DocumentBuilderFactory used in DictionaryKeysHelper.java, blocking DOCTYPE declarations outright. No workaround is viable in older versions short of refusing to validate untrusted PDFs.

Reported by wodzen.

References: [1][2]

Related research