veraPDF CVE-2026-54079

Exploitation requires that the target validate an attacker-supplied PDF against the PDF/UA-1 profile - either explicitly selected or reached through flavour auto-detection on a PDF that declares PDF/UA-1 conformance - because getdynamicRender() is invoked by the bundled PDF/UA-1 'dynamicRender != required' rule; no other configuration, operator action, or authentication is required. The attacker must be able to get their PDF into the validation pipeline and, for data exfiltration, must host an out-of-band endpoint for the parameter-entity technique since the parsed value is not echoed into the report. The principal limiting factor is deployment exposure: the flaw is only remotely reachable if veraPDF processes externally-supplied PDFs (e.g. an upload/ingest service); purely local CLI validation of trusted files sharply reduces real-world reach. Exploitation is also confined to the vulnerable version ranges (validation-model / validation-model-jakarta 1.17.35-1.30.1 and 1.31.1-1.31.70).

No CVSS score or vector was supplied by the source, so severity signals must be inferred. EPSS is unavailable, KEV status is not listed, and no POC is referenced - meaning this is not confirmed as actively exploited or widely weaponized. However, the technical prerequisites are unusually low for an XXE: the vulnerable code path is triggered by default when validating any PDF that declares or is auto-detected as PDF/UA-1, requiring no special configuration or authentication on the document itself. The real-world risk therefore hinges on deployment: veraPDF used as a batch/CLI tool on trusted local files is low risk, but veraPDF embedded in a server or pipeline that validates externally-submitted PDFs (document intake portals, archiving/ingest workflows) faces genuine remote file-read and SSRF exposure. Note the advisory's caveat that the PDF/UA-1 rule consumes but does not echo the parsed value, so exfiltration relies on out-of-band parameter-entity techniques rather than in-band reflection - a modest but non-blocking complication for an attacker. My assessed severity is High (network-exposed processing) but degrades to Medium/Low for local-only usage; verify how veraPDF is exposed in your environment.

An attacker uploads a crafted PDF to a document-ingest or archiving service that runs veraPDF PDF/UA-1 validation on submissions. The PDF's /AcroForm /XFA stream embeds a DOCTYPE with external parameter entities that read a local file (e.g. /etc/passwd or application secrets) and smuggle its contents to an attacker-controlled server over an out-of-band channel, or force the server to issue requests to internal-only endpoints (SSRF). No public POC is referenced, and because the impact is network-vector with low complexity and no privileges on the document, exploitation succeeds automatically once the malicious PDF is validated.