CVE-2026-54079

CVE-2026-54079 affects veraPDF Validation. The XXE flaw resides in veraPDF-validation’s GFPDAcroForm.getdynamicRender() and is triggered by a crafted PDF containing a malicious XFA stream, causing external entity expansion during PDF/UA-1 validation. Consequences include local file disclosure or ...

CVE-2026-54079 veraPDF Validation XXE via XFA

veraPDF validation provides PDF/A and PDF/UA validation, feature reporting, and metadata repair. From 1.17.35 until 1.30.2 and 1.31.71, veraPDF-validation contains an XML External Entity XXE vulnerability in validation-model/src/main/java/org/verapdf/gf/model/impl/pd/GFPDAcroForm.java in the...

EUVD-2024-3420

Malicious code in bioql PyPI...

CVE-2024-52800

veraPDF is an open source PDF/A validation library. Executing policy checks using custom schematron files via the CLI invokes an XSL transformation that may theoretically lead to a remote code execution RCE vulnerability. This doesn't affect the standard validation and policy checks functionality...

The vulnerability of the mergeEnabledFeaturesFromPolicy() function in the PDF compliance checking library veraPDF allows attackers to perform XXE attacks.

The vulnerability of the mergeEnabledFeaturesFromPolicy function in the PDF compliance checking library veraPDF is related to an incorrect limitation on XML links to external objects. Exploiting this vulnerability could allow a malicious actor, operating remotely, to carry out XXE attacks...

eu.europa.ec.joinup.sd-dss:dss-cookbook (>=6.0 <=6.2.RC1), eu.europa.ec.joinup.sd-dss:dss-jacoco-coverage (>=6.0 <=6.2.RC1) +13 more potentially affected by CVE-2024-52800 via org.verapdf:core-jakarta (>=1.24.1 <=1.26.1)

org.verapdf:core-jakarta MAVEN version =1.24.1, =6.0, =6.0, =6.0, =0.5.0, =0.6.0, =6.0.d4j.1, =6.0.d4j.1, =6.0.d4j.1, =2.12.0, =3.2.0, =3.2.0, =1.24.1, =1.24.1, =1.24.1, =1.26.1 - org.verapdf:wcag-validation-jakarta =1.26.1 Source cves: CVE-2024-52800 Source advisory: OSV:GHSA-4CX5-89VM-833X...

veraPDF CLI has potential XXE (XML External Entity Injection) vulnerability

Impact Executing policy checks using custom schematron files via the CLI invokes an XSL transformation that may theoretically lead to a remote code execution RCE vulnerability. Patches We are currently working on a patch that will be released when ready. Workarounds This doesn't affect the standa...

GHSA-4CX5-89VM-833X veraPDF CLI has potential XXE (XML External Entity Injection) vulnerability

Impact Executing policy checks using custom schematron files via the CLI invokes an XSL transformation that may theoretically lead to a remote code execution RCE vulnerability. Patches We are currently working on a patch that will be released when ready. Workarounds This doesn't affect the standa...

CVE-2024-52800

veraPDF is an open source PDF/A validation library. Executing policy checks using custom schematron files via the CLI invokes an XSL transformation that may theoretically lead to a remote code execution RCE vulnerability. This doesn't affect the standard validation and policy checks functionality...

CVE-2024-52800

The CVE-2024-52800 issue affects veraPDF: when executing policy checks via the CLI using custom Schematron-based policy files, an XSL transformation may enable a remote code execution (RCE) or XXE-type vector. The vulnerability concerns the policy-check workflow (policy profiles with user-provide...

CVE-2024-52800 Potential XXE (XML External Entity Injection) vulnerability in veraPDF CLI

veraPDF is an open source PDF/A validation library. Executing policy checks using custom schematron files via the CLI invokes an XSL transformation that may theoretically lead to a remote code execution RCE vulnerability. This doesn't affect the standard validation and policy checks functionality...

CVE-2024-52800 Potential XXE (XML External Entity Injection) vulnerability in veraPDF CLI

veraPDF is an open source PDF/A validation library. Executing policy checks using custom schematron files via the CLI invokes an XSL transformation that may theoretically lead to a remote code execution RCE vulnerability. This doesn't affect the standard validation and policy checks functionality...

veraPDF-library 代码问题漏洞

veraPDF-library is veraPDF open source an open source PDF/A validation library . A code issue vulnerability exists in veraPDF-library, which stems from the fact that using a custom schematron file enforcement policy check via the CLI invokes an XSL transformation, which could theoretically lead t...

PT-2024-8938 · Verapdf · Verapdf

Name of the Vulnerable Software and Affected Versions: veraPDF affected versions not specified Description: The issue is related to the execution of policy checks using custom schematron files via the CLI, which invokes an XSL transformation that may theoretically lead to a remote code execution...

eu.europa.ec.joinup.sd-dss:dss-cookbook (=6.0), eu.europa.ec.joinup.sd-dss:dss-jacoco-coverage (=6.0) +7 more potentially affected by CVE-2024-28109 via org.verapdf:core-jakarta (=1.24.1)

org.verapdf:core-jakarta MAVEN version =1.24.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.verapdf:core-jakarta and may be impacted: - eu.europa.ec.joinup.sd-dss:dss-cookbook =6.0 - eu.europa.ec.joinup.sd-dss:dss-jacoco-coverage =6.0 -...

GHSA-QXQF-2MFX-X8JW veraPDF has potential XSLT injection vulnerability when using policy files

Impact Executing policy checks using custom schematron files invokes an XSL transformation that may theoretically lead to a remote code execution RCE vulnerability. Patches This has been patched and users should upgrade to veraPDF v1.24.2 Workarounds This doesn't affect the standard validation an...

veraPDF has potential XSLT injection vulnerability when using policy files

Impact Executing policy checks using custom schematron files invokes an XSL transformation that may theoretically lead to a remote code execution RCE vulnerability. Patches This has been patched and users should upgrade to veraPDF v1.24.2 Workarounds This doesn't affect the standard validation an...

XML Injection

verapdf is vulnerable to Remote Code Execution RCE. The vulnerability is caused by executing policy checks using custom schematron files, which invokes an XSL transformation that could lead to code execution...

CVE-2024-28109

veraPDF-library is a PDF/A validation library. Executing policy checks using custom schematron files invokes an XSL transformation that could lead to a remote code execution RCE vulnerability. This vulnerability is fixed in 1.24.2...

CVE-2024-28109 Potential XSLT injection vulnerability when using policy files

veraPDF-library is a PDF/A validation library. Executing policy checks using custom schematron files invokes an XSL transformation that could lead to a remote code execution RCE vulnerability. This vulnerability is fixed in 1.24.2...