A high-severity XML External Entity (XXE) vulnerability in the veraPDF validation model allows unauthenticated attackers to access sensitive system files.

This vulnerability is an Improper Restriction of XML External Entity Reference (CWE-611). The issue exists within the validation model and allows an unauthenticated remote attacker to perform unauthorized file access by submitting specially crafted XML content.

Successful exploitation of this vulnerability could lead to the unauthorized disclosure of sensitive local files on the server hosting the veraPDF validation model. Given the CVSS score of 8.7, this represents a significant risk to data confidentiality, potentially exposing configuration files, credentials, or other proprietary information.

Immediate Action: Update the veraPDF validation-model or validation-model-jakarta components to version 1.30.2 or 1.31.71 immediately.

Proactive Monitoring: Monitor application logs for unusual XML input patterns or requests containing unexpected external entity references.

Compensating Controls: Deploy a Web Application Firewall (WAF) configured to inspect and block incoming XML payloads containing Document Type Definition (DTD) declarations or external entity references.

Public Exploit Available: No (exploit_available: false)

This vulnerability presents a high risk to organizational data security. Administrators should prioritize the update to the patched versions (1.30.2 or 1.31.71) to eliminate the XXE vector. If immediate patching is not feasible, implement strict input validation or WAF rules to sanitize XML processing tasks.