CVE-2024-28109 — Vulnerability in org.verapdf:library-arlington —...

HIGH

veraPDF has potential XSLT injection vulnerability when using policy files

Published May 20, 2024Updated May 14, 2026Source: osv

Summary

### Impact Executing policy checks using custom schematron files invokes an XSL transformation that may theoretically lead to a remote code execution (RCE) vulnerability. ### Patches This has been patched and users should upgrade to veraPDF v1.24.2 ### Workarounds This doesn't affect the standard validation and policy checks functionality, veraPDF's common use cases. Most veraPDF users don't insert any custom XSLT code into policy profiles, which are based on Schematron syntax rather than direct XSL transforms. For users who do, only load custom policy files from sources you trust. ### References Original issue: <https://github.com/veraPDF/veraPDF-library/issues/1415>

Advisory Timeline

First published May 20, 2024 (875 days ago).
Last revised May 14, 2026 — 724 days after initial publication.

Remediation

Upgrade to the fixed version using your package manager.

Maven

Update org.verapdf:library-arlington to 1.25.127 or later

<!-- Update pom.xml dependency version to 1.25.127 for org.verapdf:library-arlington -->

Maven

Update org.verapdf:core-jakarta to 1.24.2 or later

<!-- Update pom.xml dependency version to 1.24.2 for org.verapdf:core-jakarta -->

Maven

Update org.verapdf:verapdf-library to 1.24.2 or later

<!-- Update pom.xml dependency version to 1.24.2 for org.verapdf:verapdf-library -->

Maven

Update org.verapdf:library-jakarta to 1.24.2 or later

<!-- Update pom.xml dependency version to 1.24.2 for org.verapdf:library-jakarta -->

Maven

Update org.verapdf:verapdf-library-arlington to 1.25.127 or later

<!-- Update pom.xml dependency version to 1.25.127 for org.verapdf:verapdf-library-arlington -->

Maven

Update org.verapdf:core to 1.24.2 or later

<!-- Update pom.xml dependency version to 1.24.2 for org.verapdf:core -->

Maven

Update org.verapdf:verapdf-library-jakarta to 1.24.2 or later

<!-- Update pom.xml dependency version to 1.24.2 for org.verapdf:verapdf-library-jakarta -->

Maven

Update org.verapdf:library to 1.24.2 or later

<!-- Update pom.xml dependency version to 1.24.2 for org.verapdf:library -->

Maven

Update org.verapdf:core-arlington to 1.25.127 or later

<!-- Update pom.xml dependency version to 1.25.127 for org.verapdf:core-arlington -->

After upgrading, run your dependency scanner again to confirm the vulnerability is resolved.

Affected Packages (9)

Affects 1 ecosystem: maven (9).

Package	Ecosystem	Affected	Fixed In
org.verapdf:library-arlington	maven	All versions	1.25.127
org.verapdf:core-jakarta	maven	1.24.1	1.24.2
org.verapdf:verapdf-library	maven	1.10.1, 1.10.2, 1.10.3, 1.12.1 (+21 more)	1.24.2
org.verapdf:library-jakarta	maven	All versions	1.24.2
org.verapdf:verapdf-library-arlington	maven	All versions	1.25.127
org.verapdf:core	maven	1.10.1, 1.10.2, 1.10.3, 1.12.1 (+22 more)	1.24.2
org.verapdf:verapdf-library-jakarta	maven	1.24.1	1.24.2
org.verapdf:library	maven	All versions	1.24.2
org.verapdf:core-arlington	maven	All versions	1.25.127

Vulnerability Classification

Common Weakness Enumeration (CWE) identifiers for this vulnerability type.

CWE-91
View on MITRE

CVSS Score Breakdown

What the CVSS (Common Vulnerability Scoring System) 8.1 score means for each attack dimension.

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

References

Frequently Asked Questions

What is CVE-2024-28109?: veraPDF has potential XSLT injection vulnerability when using policy files This vulnerability has been assigned a severity rating of HIGH (CVSS score: 8.1/10).
How do I check if my project is affected by CVE-2024-28109?: CVE-2024-28109 affects org.verapdf:library-arlington, org.verapdf:core-jakarta and org.verapdf:verapdf-library (and 6 more). Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2024-28109 and 200,000+ other known vulnerabilities.

Severity & Exploitability

CVSS Score

8.1

High exploitability or significant impact. Prioritize remediation within days.

Also Known As

GHSA-qxqf-2mfx-x8jw

Related CVEs

CVE-2026-61570
HIGH
MPXJ: XXE Vulnerability in MerlinReader
CVE-2026-107725
HIGH
Hazelcast has an authorization bypass in IMap Predicates API

More Maven advisories

Check if you're affected

Scan your dependencies to see if this vulnerability affects your projects.

Scan Your Dependencies