The veraPDF validation component contains a classic XML External Entity (XXE) flaw in its PDFAValidator.validate and GFPDAcroForm.getdynamicRender methods. The weakness is triggered when the library uses the default DocumentBuilderFactory to parse rich‑text annotation, form‑field values, or XFA configuration data from PDFs that are not trusted. An attacker who crafts a PDF with a malicious DOCTYPE declaration can cause the XML parser to resolve external entities, leading to local file disclosure and potentially outbound network requests originating from the host that is validating the file. The bug does not provide direct code execution but can be leveraged to exfiltrate data or contact remote servers stealthily.

The vulnerability exists in veraPDF-validation releases from 1.25.73 through the final bytes of 1.30.1 and from 1.31.70 and earlier. Versions 1.30.2 and 1.31.71 contain the fix. Any system that processes untrusted PDFs via this library, especially in document conversion or validation pipelines, is at risk unless it has been upgraded to a patched release or has applied defensive configuration changes.

The CVSS score of 6.5 classifies it as moderate severity, and the EPSS score of less than 1 % indicates a low probability of exploitation in the wild. The flaw is not listed in CISA’s KEV catalog. Attackers must supply a malicious PDF, so the attack surface is confined to environments that accept or validate arbitrary documents. While the immediate danger is information disclosure and covert outbound traffic, the underlying XXE weakness could serve as a stepping stone for more serious attacks if combined with other vulnerabilities.