CyberRota Analysis
AI-GeneratedThe veraPDF validation model is vulnerable to an XML External Entity (XXE) attack, which can lead to local file disclosure and unauthorized outbound network requests when processing untrusted PDFs. This issue affects versions from 1.25.73 to 1.30.1 and 1.31.70, and users of these versions should prioritize upgrading to 1.30.2 or 1.31.71 to mitigate potential security risks. Organizations handling PDF validation in their workflows should take immediate action to address this vulnerability.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
veraPDF validation model is an implementation of the veraPDF validation model. From 1.25.73 until 1.30.2 and 1.31.71, veraPDF-validation contains an XML External Entity vulnerability in PDFAValidator.validate(...) and GFPDAcroForm.getdynamicRender(), where default DocumentBuilderFactory parsing of rich-text annotation or form-field values and XFA configurations in untrusted PDFs can allow local file disclosure and outbound network requests. This issue is fixed in versions 1.30.2 and 1.31.71.