CVE-2026-54078 veraPDF Validation XXE via Rich Text
An attacker can exploit an XML External Entity vulnerability in veraPDF to read local files via a crafted PDF rich-text entry.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-54078?
CVE-2026-54078 is a high-severity vulnerability in veraPDF-validation, published on 29 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
veraPDF validation model is an implementation of the veraPDF validation model. From 1.25.73 until 1.30.2 and 1.31.71, veraPDF-validation contains an XML External Entity (XXE) vulnerability in validation-model/src/main/java/org/verapdf/gf/model/tools/DictionaryKeysHelper.java in getRichTextStringOrStreamEntryStringRepresentation(), where a crafted PDF containing a malicious rich-text /RC or /RV entry can cause external entity expansion and reflect local file contents into the validation report. This issue is fixed in versions 1.30.2 and 1.31.71.
Weakness: CWE-611
Which versions are affected by CVE-2026-54078?
8 open source packages ship an affected version, including org.verapdf:validation-model and org.verapdf:validation-model-jakarta.
| Package | Affected | Fixed in |
|---|---|---|
org.verapdf:validation-model Maven | From 1.25.73 | 1.30.2 |
org.verapdf:validation-model Maven | From 1.25.73 | 1.30.2 |
org.verapdf:validation-model Maven | From 1.31.1 | 1.31.71 |
org.verapdf:validation-model Maven | From 1.31.1 | 1.31.71 |
org.verapdf:validation-model-jakarta Maven | From 1.25.73 | 1.30.2 |
org.verapdf:validation-model-jakarta Maven | From 1.25.73 | 1.30.2 |
2 more packages
org.verapdf:validation-model-jakarta Maven | From 1.31.1 | 1.31.71 |
org.verapdf:validation-model-jakarta Maven | From 1.31.1 | 1.31.71 |
How do I fix CVE-2026-54078?
Upgrade org.verapdf:validation-model to a fixed version for your release line: 1.30.2 or 1.31.71.
Is CVE-2026-54078 being exploited?
There is no known exploitation of CVE-2026-54078 in the wild and no public exploit code.
Sources
Also known as GHSA-3jh7-wm29-q568.