CyberRota Analysis
AI-GeneratedThe veraPDF validation model is vulnerable to an XML External Entity (XXE) attack in specific versions, allowing crafted PDFs to expose local file contents in the validation report. This could lead to unauthorized data disclosure, making it critical for users of affected versions (1.25.73 to 1.30.2 and 1.31.71) to upgrade to the patched versions (1.30.2 or 1.31.71) to mitigate the risk. Organizations utilizing veraPDF for PDF validation should prioritize this update to protect sensitive information.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
veraPDF validation model is an implementation of the veraPDF validation model. From 1.25.73 until 1.30.2 and 1.31.71, veraPDF-validation contains an XML External Entity (XXE) vulnerability in validation-model/src/main/java/org/verapdf/gf/model/tools/DictionaryKeysHelper.java in getRichTextStringOrStreamEntryStringRepresentation(), where a crafted PDF containing a malicious rich-text /RC or /RV entry can cause external entity expansion and reflect local file contents into the validation report. This issue is fixed in versions 1.30.2 and 1.31.71.