org.verapdf/core vulnerabilities

Latest org.verapdf/core CVEs

Newest publication first

1. CVE-2024-52800 Potential XXE (XML External Entity Injection) vulnerability in veraPDF CLI

   Published 2024-11-29

   Low·CVSS 2.3 EPSS 1.1%

   veraPDF is an open source PDF/A validation library. Executing policy checks using custom schematron files via the CLI invokes an XSL transformation that may theoretically lead to a remote code execution (RCE) vulnerability. This doesn't affect the standard validation and policy c...

2. CVE-2024-28109 Potential XSLT injection vulnerability when using policy files

   Published 2024-03-28

   High·CVSS 8.1 EPSS 1.0%

   veraPDF-library is a PDF/A validation library. Executing policy checks using custom schematron files invokes an XSL transformation that could lead to a remote code execution (RCE) vulnerability. This vulnerability is fixed in 1.24.2.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.