veraPDF XXE and SSRF Vulnerability (CVE-2025-54078) Advisory and Fix Guide

github.com 2026-07-30查看中文 →

Security AdvisoryCVE-2025-54078MediumveraPDF

Affected:

org.verapdf:validation-model >= 1.25.73, <= 1.30.1; >= 1.31.1, <= 1.31.70
org.verapdf:validation-model-jakarta >= 1.25.73, <= 1.30.1; >= 1.31.1, <= 1.31.70

Fixed in:

org.verapdf:validation-model 1.30.2
org.verapdf:validation-model-jakarta 1.31.71

Referenced CVEs: CVE-2026-54078 · 8.7

文章内图片已隐藏以节省流量 · Upgrade to Pro to view images & offline archive

This content was auto-fetched from github.com, cleaned by our LLM pipeline, and translated to English. View original.

More from this source

rclone SFTP Filename Injection RCE via PowerShell Unicode Quotes (CVE-2026-7232) 2026-08-06 Restic serve restic Path Traversal Leading to Directory Traversal (Pre-Auth) 2026-08-06 PowerShell Command Injection Fix: Handling Unicode Quotes in Shell Escape 2026-08-06 libproxy http.go Unrestricted HTTP CONNECT Response Headers Leading to OOM 2026-08-06 Path Traversal (CWE-22) Vulnerability Fix and POC 2026-08-06

Offline Archive

Offline screenshot & PDF are Pro-exclusive