THREATOPS
THREAT OPS › Threat News › [GHSA] GHSA-3jh7-wm29-q568 (high) — veraPDF Validation XXE via Rich Text

[GHSA] GHSA-3jh7-wm29-q568 (high) — veraPDF Validation XXE via Rich Text

medgithub_advisoriesPublished 2026-07-29

GHSA-3jh7-wm29-q568 Severity: high CVE: CVE-2026-54078

veraPDF Validation XXE via Rich Text

## Summary

**Description** An XML External Entity Injection (CWE-611) vulnerability in veraPDF allows a remote attacker to read arbitrary files on the server file system and perform Server-Side Request Forgery by submitting a crafted PDF containing a malicious rich-text (/RC or /RV) entry. This affec

Indicators of compromise

Original source: https://github.com/advisories/GHSA-3jh7-wm29-q568