{"id":"CVE-2026-54078","summary":"veraPDF Validation XXE via Rich Text","details":"veraPDF validation model is an implementation of the veraPDF validation model. From 1.25.73 until 1.30.2 and 1.31.71, veraPDF-validation contains an XML External Entity (XXE) vulnerability in validation-model/src/main/java/org/verapdf/gf/model/tools/DictionaryKeysHelper.java in getRichTextStringOrStreamEntryStringRepresentation(), where a crafted PDF containing a malicious rich-text /RC or /RV entry can cause external entity expansion and reflect local file contents into the validation report. This issue is fixed in versions 1.30.2 and 1.31.71.","aliases":["GHSA-3jh7-wm29-q568"],"modified":"2026-08-12T16:41:11.578668Z","published":"2026-07-29T15:11:05.239Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54078.json","cna_assigner":"GitHub_M","cwe_ids":["CWE-611"]},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54078.json"},{"type":"ADVISORY","url":"https://github.com/veraPDF/veraPDF-validation/security/advisories/GHSA-3jh7-wm29-q568"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-54078"},{"type":"FIX","url":"https://github.com/veraPDF/veraPDF-validation/commit/94caa46c1a594512247fbd46c808edae39469542"},{"type":"FIX","url":"https://github.com/veraPDF/veraPDF-validation/commit/cacd9436d0de40b0e58cc7d2dbb06451619e61ec"},{"type":"FIX","url":"https://github.com/veraPDF/veraPDF-validation/pull/730"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/verapdf/verapdf-validation","events":[{"introduced":"077e3f87e8549ca50e51c314342e52d67ed02793"},{"introduced":"422da4644cc98b2d643b81dbd7ada5dabf12432b"},{"fixed":"94caa46c1a594512247fbd46c808edae39469542"},{"fixed":"cacd9436d0de40b0e58cc7d2dbb06451619e61ec"}],"database_specific":{"extracted_events":[{"introduced":"1.25.73"},{"fixed":"1.30.2"},{"introduced":"1.31.1"},{"fixed":"1.31.71"}],"source":["AFFECTED_FIELD","REFERENCES"]}}],"versions":["v1.30.1","v1.31.70","v1.31.69","v1.31.68","v1.31.67","v1.31.66","v1.31.65","v1.31.64","v1.31.63","v1.31.62","v1.31.61","v1.31.60","v1.31.59","v1.31.58","v1.31.57","v1.31.56","v1.31.55","v1.31.54","v1.31.53","v1.31.52","v1.31.51","v1.31.50","v1.31.49","v1.31.48","v1.31.47","v1.31.46","v1.31.45","v1.31.44","v1.31.43","v1.31.42","v1.31.40","v1.31.39","v1.31.38","v1.31.37","v1.30.0-RC1","v1.31.36","v1.31.35","v1.31.34","v1.31.33","v1.31.32","v1.31.31","v1.31.30","v1.31.29","v1.31.28","v1.31.27","v1.31.26","v1.31.25","v1.31.24","v1.31.23","v1.31.22","v1.31.21","v1.31.20","v1.31.19","v1.31.18","v1.31.17","v1.31.16","v1.31.15","v1.31.14","v1.31.13","v1.31.9","v1.31.8","v1.31.7","v1.31.6","v1.31.12","v1.31.11","v1.31.10","v1.31.5","v1.31.4","v1.31.3","v1.31.2","v1.31.1","v1.29.201","v1.29.200","v1.29.199","v1.29.198","v1.29.197","v1.29.196","v1.29.195","v1.29.194","v1.29.193","v1.29.192","v1.29.191","v1.29.190","v1.29.189","v1.29.188","v1.29.187","v1.29.186","v1.29.184","v1.29.183","v1.29.182","v1.29.181","v1.29.180","v1.29.179","v1.29.178","v1.29.177","v1.29.176","v1.29.175","v1.29.174","v1.29.173","v1.29.172","v1.29.171","v1.29.170","v1.29.169","v1.29.167","v1.29.166","v1.29.165","v1.29.164","v1.29.163","v1.29.162","v1.29.161","v1.29.160","v1.29.159","v1.29.158","v1.29.157","v1.29.155","v1.29.154","v1.29.153","v1.29.152","v1.29.151","v1.29.150","v1.29.149","v1.29.148","v1.29.147","v1.29.146","v1.29.145","v1.29.144","v1.29.143","v1.29.142","v1.29.141","v1.29.140","v1.29.139","v1.29.138","v1.29.137","v1.29.136","v1.29.135","v1.29.134","v1.29.133","v1.29.132","v1.29.131","v1.29.130","v1.29.129","v1.29.128","v1.29.127","v1.29.126","v1.29.125","v1.29.124","v1.29.123","v1.29.122","v1.29.121","v1.29.120","v1.29.119","v1.29.118","v1.29.117","v1.29.116","v1.29.113","v1.29.112","v1.29.111","v1.29.110","v1.29.109","v1.29.108","v1.29.107","v1.29.106","v1.29.105","v1.29.104","v1.29.103","v1.29.102","v1.29.101","v1.29.99","v1.29.98","v1.29.100","v1.29.97","v1.29.96","v1.29.95","v1.29.94","v1.29.93","v1.29.92","v1.29.91","v1.29.90","v1.29.89","v1.29.88","v1.29.87","v1.29.86","v1.29.85","v1.29.84","v1.29.83","v1.29.82","v1.29.81","v1.29.80","v1.29.79","v1.29.78","v1.29.77","v1.29.76","v1.29.75","v1.29.74","v1.29.73","v1.29.72","v1.29.71","v1.29.70","v1.29.69","v1.29.68","v1.29.67","v1.29.66","v1.29.65","v1.29.64","v1.29.63","v1.29.62","v1.29.60","v1.29.59","v1.29.58","v1.29.57","v1.29.56","v1.29.55","v1.29.54","v1.29.53","v1.29.52","v1.29.51","v1.29.50","v1.29.49","v1.29.48","v1.29.47","v1.29.46","v1.29.45","v1.29.44","v1.29.43","v1.29.42","v1.29.41","v1.29.40","v1.29.39","v1.29.38","v1.29.37","v1.29.36","v1.29.35","v1.29.33","v1.29.32","v1.29.31","v1.29.30","v1.29.29","v1.29.28","v1.29.27","v1.29.26","v1.29.25","v1.29.24","v1.29.23","v1.29.22","v1.29.21","v1.29.20","v1.29.19","v1.29.18","v1.29.17","v1.29.16","v1.29.15","v1.29.14","v1.29.9","v1.29.8","v1.29.7","v1.29.6","v1.29.5","v1.29.13","v1.29.12","v1.29.11","v1.29.10","v1.29.4","v1.29.3","v1.29.2","v1.29.1","v1.27.112","v1.27.111","v1.27.110","v1.27.109","v1.27.108","v1.27.107","v1.27.106","v1.27.105","v1.27.104","v1.27.103","v1.27.102","v1.27.101","v1.27.100","v1.27.99","v1.27.98","v1.27.97","v1.27.96","v1.27.95","v1.27.94","v1.27.93","v1.27.92","v1.27.91","v1.27.90","v1.27.89","v1.27.88","v1.27.87","v1.27.86","v1.27.85","v1.27.84","v1.27.83","v1.27.82","v1.27.80","v1.27.79","v1.27.78","v1.27.77","v1.27.76","v1.27.75","v1.27.74","v1.27.73","v1.27.72","v1.27.71","v1.27.70","v1.27.69","v1.27.68","v1.27.67","v1.27.66","v1.27.65","v1.27.64","v1.27.63","v1.27.62","v1.27.61","v1.27.60","v1.27.59","v1.27.58","v1.27.57","v1.27.56","v1.27.55","v1.27.54","v1.27.52","v1.27.51","v1.27.50","v1.27.49","v1.27.48","v1.27.47","v1.27.46","v1.27.45","v1.27.44","v1.27.43","v1.27.42","v1.27.41","v1.27.40","v1.27.39","v1.27.36","v1.27.35","v1.27.34","v1.27.33","v1.27.32","v1.27.31","v1.27.30","v1.27.29","v1.27.28","v1.27.27","v1.27.26","v1.27.25","v1.27.24","v1.27.22","v1.27.21","v1.27.18","v1.27.17","v1.27.16","v1.27.15","v1.27.14","v1.27.12","v1.27.11","v1.27.9","v1.27.8","v1.27.7","v1.27.6","v1.27.5","v1.27.4","v1.27.3","v1.27.2","v1.27.1","v1.25.297","v1.25.296","v1.25.294","v1.25.293","v1.25.292","v1.25.291","v1.25.290","v1.25.289","v1.25.288","v1.25.287","v1.25.286","v1.25.285","v1.25.284","v1.25.283","v1.25.282","v1.25.280","v1.25.279","v1.25.278","v1.25.277","v1.25.276","v1.25.275","v1.25.274","v1.25.273","v1.25.272","v1.25.271","v1.25.270","v1.25.269","v1.25.268","v1.25.267","v1.25.266","v1.25.265","v1.25.264","v1.25.263","v1.25.262","v1.25.261","v1.25.260","v1.25.259","v1.25.258","v1.25.257","v1.25.256","v1.25.255","v1.25.254","v1.25.253","v1.25.252","v1.25.251","v1.25.250","v1.25.249","v1.25.248","v1.25.247","v1.25.246","v1.25.245","v1.25.244","v1.25.243","v1.25.242","v1.25.241","v1.25.240","v1.25.239","v1.25.237","v1.25.236","v1.25.235","v1.25.234","v1.25.233","v1.25.232","v1.25.231","v1.25.230","v1.25.229","v1.25.228","v1.25.227","v1.25.226","v1.25.225","v1.25.224","v1.25.222","v1.25.221","v1.25.220","v1.25.219","v1.25.218","v1.25.217","v1.25.216","v1.25.215","v1.25.214","v1.25.213","v1.25.212","v1.25.211","v1.25.210","v1.25.209","v1.25.208","v1.25.207","v1.25.206","v1.25.205","v1.25.204","v1.25.203","v1.25.202","v1.25.200","v1.25.199","v1.25.198","v1.25.197","v1.25.195","v1.25.194","v1.25.193","v1.25.192","v1.25.191","v1.25.190","v1.25.189","v1.25.188","v1.25.187","v1.25.186","v1.25.185","v1.25.184","v1.25.183","v1.25.182","v1.25.181","v1.25.180","v1.25.179","v1.25.178","v1.25.177","v1.25.175","v1.25.174","v1.25.173","v1.25.171","v1.25.170","v1.25.169","v1.25.168","v1.25.167","v1.25.166","v1.25.165","v1.25.164","v1.25.162","v1.25.161","v1.25.160","v1.25.159","v1.25.158","v1.25.157","v1.25.155","v1.25.154","v1.25.153","v1.25.152","v1.25.151","v1.25.148","v1.25.147","v1.25.146","v1.25.145","v1.25.144","v1.25.143","v1.25.142","v1.25.141","v1.25.140","v1.25.139","v1.25.138","v1.25.137","v1.25.136","v1.25.134","v1.25.133","v1.25.132","v1.25.130","v1.25.129","v1.25.128","v1.25.127","v1.25.126","v1.25.125","v1.25.124","v1.25.123","v1.25.122","v1.25.121","v1.25.120","v1.25.119","v1.25.118","v1.25.117","v1.25.116","v1.25.115","v1.25.114","v1.25.113","v1.25.112","v1.25.111","v1.25.110","v1.25.109","v1.25.107","v1.25.106","v1.25.104","v1.25.103","v1.25.102","v1.25.101","v1.25.99","v1.25.100","v1.25.98","v1.25.96","v1.25.94","v1.25.91","v1.25.90","v1.25.89","v1.25.88","v1.25.93","v1.25.92","v1.25.87","v1.25.86","v1.25.85","v1.25.84","v1.25.83","v1.25.81","v1.25.78","v1.25.77","v1.25.76","v1.25.75","v1.25.74","v1.25.73"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-54078.json","vanir_signatures_modified":"2026-08-12T16:41:11Z","vanir_signatures":[{"deprecated":false,"digest":{"function_hash":"84523570243038445086964814829091844746","length":1305},"id":"CVE-2026-54078-1ddb7fb8","signature_type":"Function","signature_version":"v1","source":"https://github.com/verapdf/verapdf-validation/commit/cacd9436d0de40b0e58cc7d2dbb06451619e61ec","target":{"file":"validation-model/src/main/java/org/verapdf/gf/model/impl/pd/GFPDAcroForm.java","function":"getdynamicRender"}},{"signature_version":"v1","source":"https://github.com/verapdf/verapdf-validation/commit/94caa46c1a594512247fbd46c808edae39469542","target":{"file":"validation-model/src/main/java/org/verapdf/gf/model/impl/pd/GFPDAcroForm.java"},"deprecated":false,"digest":{"line_hashes":["224122008124316087517590342109031050663","88048950692631229518977725587237729259","329174262173376905680677787564436058717","276355370668200214153416029212564586906","263119862434061265184620980021317491800","33242040244361693929954625443604141376","126539860630100263837638674742031266554","229985680957967251586128132959416436073","260554056158541558900419755741101522822","233237576012305782689834570942785120635","83807986321847110107054317645679185075","108793449135511637112008706741446565529","192928613343170563989744308804466527021","181967972905036174132593291208197868116","314500873251140149305505639542828011506"],"threshold":0.9},"id":"CVE-2026-54078-367f4dfb","signature_type":"Line"},{"id":"CVE-2026-54078-87be32e6","signature_type":"Line","signature_version":"v1","source":"https://github.com/verapdf/verapdf-validation/commit/cacd9436d0de40b0e58cc7d2dbb06451619e61ec","target":{"file":"validation-model/src/main/java/org/verapdf/gf/model/tools/DictionaryKeysHelper.java"},"deprecated":false,"digest":{"line_hashes":["184693522532910561717232635085018616684","106606769542418873241525053020889232503","50398226909081604765952398423911900792","284986161873876603964424609286888119044","240001565866012223779249132388089288721","60876442109708633784856940187678938625","319618911948106277306578438660822253805","135980471458860927603837638935153002740","66154683653437362618359887485199749707","154202297480320180997039849395455661801"],"threshold":0.9}},{"digest":{"function_hash":"261017582327460494517843200780602632571","length":786},"id":"CVE-2026-54078-8d6f37f3","signature_type":"Function","signature_version":"v1","source":"https://github.com/verapdf/verapdf-validation/commit/cacd9436d0de40b0e58cc7d2dbb06451619e61ec","target":{"function":"getRichTextStringOrStreamEntryStringRepresentation","file":"validation-model/src/main/java/org/verapdf/gf/model/tools/DictionaryKeysHelper.java"},"deprecated":false},{"id":"CVE-2026-54078-9ade6906","signature_type":"Function","signature_version":"v1","source":"https://github.com/verapdf/verapdf-validation/commit/94caa46c1a594512247fbd46c808edae39469542","target":{"file":"validation-model/src/main/java/org/verapdf/gf/model/impl/pd/GFPDAcroForm.java","function":"getdynamicRender"},"deprecated":false,"digest":{"function_hash":"84523570243038445086964814829091844746","length":1305}},{"source":"https://github.com/verapdf/verapdf-validation/commit/94caa46c1a594512247fbd46c808edae39469542","target":{"file":"validation-model/src/main/java/org/verapdf/gf/model/tools/DictionaryKeysHelper.java","function":"getRichTextStringOrStreamEntryStringRepresentation"},"deprecated":false,"digest":{"function_hash":"261017582327460494517843200780602632571","length":786},"id":"CVE-2026-54078-b1e86e2a","signature_type":"Function","signature_version":"v1"},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/verapdf/verapdf-validation/commit/cacd9436d0de40b0e58cc7d2dbb06451619e61ec","target":{"file":"validation-model/src/main/java/org/verapdf/gf/model/impl/pd/GFPDAcroForm.java"},"deprecated":false,"digest":{"line_hashes":["224122008124316087517590342109031050663","88048950692631229518977725587237729259","329174262173376905680677787564436058717","276355370668200214153416029212564586906","263119862434061265184620980021317491800","33242040244361693929954625443604141376","126539860630100263837638674742031266554","229985680957967251586128132959416436073","260554056158541558900419755741101522822","233237576012305782689834570942785120635","83807986321847110107054317645679185075","108793449135511637112008706741446565529","192928613343170563989744308804466527021","181967972905036174132593291208197868116","314500873251140149305505639542828011506"],"threshold":0.9},"id":"CVE-2026-54078-d53f2ff8"},{"target":{"file":"validation-model/src/main/java/org/verapdf/gf/model/tools/DictionaryKeysHelper.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["184693522532910561717232635085018616684","106606769542418873241525053020889232503","50398226909081604765952398423911900792","284986161873876603964424609286888119044","240001565866012223779249132388089288721","60876442109708633784856940187678938625","319618911948106277306578438660822253805","135980471458860927603837638935153002740","66154683653437362618359887485199749707","154202297480320180997039849395455661801"]},"id":"CVE-2026-54078-fc5fcdc8","signature_type":"Line","signature_version":"v1","source":"https://github.com/verapdf/verapdf-validation/commit/94caa46c1a594512247fbd46c808edae39469542"}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"}]}