The veraPDF-validation product suffers from a CWE-611 XML External Entity vulnerability in the PDFAValidator.validate(...) and GFPDAcroForm.getdynamicRender() functions. The vulnerability is due to the default DocumentBuilderFactory parsing untrusted XML content without properly restricting external entity references. This can lead to local file disclosure and outbound network requests when processing malicious PDF files containing crafted rich-text annotations or form-field values. Versions affected are >=1.25.73 <1.30.2 and <1.31.71. The vulnerability is resolved in versions 1.30.2 and 1.31.71.

An attacker can exploit this vulnerability by supplying a crafted PDF that triggers the vulnerable XML parsing code, potentially leading to disclosure of local files and unauthorized outbound network connections. This can compromise confidentiality but does not impact integrity or availability directly. The CVSS score of 6.5 reflects a medium severity with network attack vector, low attack complexity, no privileges required, and no user interaction needed.

The vulnerability is fixed in veraPDF-validation versions 1.30.2 and 1.31.71. Users should upgrade to at least one of these versions to remediate the issue. Patch status is confirmed by the version-based fix information. No other vendor advisory content is provided, so check the vendor's official channels for further updates or temporary mitigations if upgrading is not immediately possible.