The veraPDF-validation product suffers from an XML External Entity (XXE) vulnerability (CWE-611) in the validation-model/src/main/java/org/verapdf/gf/model/tools/DictionaryKeysHelper.java file, specifically in the getRichTextStringOrStreamEntryStringRepresentation() method. Versions from 1.25.73 until 1.30.2 and 1.31.71 are affected. A crafted PDF containing malicious rich-text /RC or /RV entries can trigger external entity expansion, allowing local file contents to be disclosed in the validation report. The issue is resolved in versions 1.30.2 and 1.31.71.

An attacker can exploit this vulnerability by submitting a specially crafted PDF file to the veraPDF-validation tool, causing it to process malicious rich-text entries that trigger XML external entity expansion. This can lead to disclosure of local file contents within the validation report, potentially exposing sensitive information. There is no indication of privilege escalation or remote code execution. The CVSS 4.0 score is 8.7 (high severity), reflecting the network attack vector, no required privileges or user interaction, and high impact on confidentiality.

Upgrade veraPDF-validation to version 1.30.2 or 1.31.71 or later, where this XXE vulnerability is fixed. No other remediation or temporary workaround is provided. Patch status is not explicitly stated in the vendor advisory, but the description confirms the issue is fixed in these versions.