veraPDF-validation is vulnerable to an XML External Entity (XXE) attack when parsing a PDF that contains a malicious rich‑text /RC or /RV entry. The vulnerable code can cause an external entity to be expanded, allowing local file contents to be read and inserted into the validation report. The weakness maps to CWE‑611 and can expose sensitive files or configuration data to an attacker who crafts a PDF for the validator to process. The vulnerability does not provide arbitrary code execution, but it can lead to data leakage and potentially aid other attacks by exposing system secrets.

The issue affects veraPDF-validation in versions ranging from 1.25.73 up to but not including 1.30.2 and 1.31.71. Any deployments of these vulnerable releases are at risk when parsing untrusted PDFs. The fix is incorporated in releases 1.30.2 and 1.31.71 and later.

The CVSS score of 8.7 indicates a high‑severity flaw. The EPSS score of less than 1 % suggests a low likelihood of widespread exploitation at this time, and the vulnerability is not currently listed in the CISA KEV catalog. The likely attack vector is an attacker providing a malicious PDF to a system running veraPDF-validation; local file contents can then be reflected in validation output. When not patched, such an exploitation could expose confidential files to the victim’s environment, potentially aiding further attacks.