{"id":"CVE-2026-54082","aliases":["GHSA-cg9x-g3gm-h5h6"],"url":"https://o3.security/vulnerability/CVE-2026-54082","summary":"veraPDF-validatio: Use of Default `DocumentBuilderFactory` leads to XXE When Processing Untrusted PDFs","details":"veraPDF validation model is an implementation of the veraPDF validation model. From 1.25.73 until 1.30.2 and 1.31.71, veraPDF-validation contains an XML External Entity vulnerability in PDFAValidator.validate(...) and GFPDAcroForm.getdynamicRender(), where default DocumentBuilderFactory parsing of rich-text annotation or form-field values and XFA configurations in untrusted PDFs can allow local file disclosure and outbound network requests. This issue is fixed in versions 1.30.2 and 1.31.71.","published":"2026-07-29T15:14:19.998Z","modified":"2026-08-12T16:41:12.063741Z","cvss":{"score":6.5,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"},"epss":{"score":0.0023,"percentile":0.13906,"asOf":"2026-09-14"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Maven","name":"org.verapdf:validation-model","fixedVersion":"1.30.2"},{"ecosystem":"Maven","name":"org.verapdf:validation-model","fixedVersion":"1.31.71"},{"ecosystem":"Maven","name":"org.verapdf:validation-model-jakarta","fixedVersion":"1.30.2"},{"ecosystem":"Maven","name":"org.verapdf:validation-model-jakarta","fixedVersion":"1.31.71"}],"fix":{"url":"https://github.com/veraPDF/veraPDF-validation/commit/94caa46c1a594512247fbd46c808edae39469542","label":"veraPDF/veraPDF-validation@94caa46"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54082.json"},{"type":"ADVISORY","url":"https://github.com/veraPDF/veraPDF-validation/security/advisories/GHSA-cg9x-g3gm-h5h6"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-54082"},{"type":"FIX","url":"https://github.com/veraPDF/veraPDF-validation/commit/94caa46c1a594512247fbd46c808edae39469542"},{"type":"FIX","url":"https://github.com/veraPDF/veraPDF-validation/commit/cacd9436d0de40b0e58cc7d2dbb06451619e61ec"},{"type":"FIX","url":"https://github.com/veraPDF/veraPDF-validation/pull/730"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T16:41:12.063741Z"}}