CyberRota Analysis
AI-GeneratedThe veraPDF validation tool, specifically versions 1.17.35 to 1.30.2 and 1.31.71, is vulnerable to an XML External Entity (XXE) attack that can be exploited through a crafted PDF containing a malicious XFA stream. This vulnerability may lead to local file disclosure or unauthorized outbound server-side requests during PDF/UA-1 validation. Organizations using affected versions should prioritize upgrading to versions 1.30.2 or 1.31.71 to mitigate potential security risks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
veraPDF validation provides PDF/A and PDF/UA validation, feature reporting, and metadata repair. From 1.17.35 until 1.30.2 and 1.31.71, veraPDF-validation contains an XML External Entity (XXE) vulnerability in validation-model/src/main/java/org/verapdf/gf/model/impl/pd/GFPDAcroForm.java in the getdynamicRender() method, where a crafted PDF containing a malicious XFA stream can cause external entity expansion during PDF/UA-1 validation and allow local file disclosure or outbound server-side requests. This issue is fixed in versions 1.30.2 and 1.31.71.