CVE-2024-52800

Deeper analysis

veraPDF, an open source PDF/A validation library, contains a theoretical remote code execution issue when policy checks are executed via the command-line interface using custom schematron files. The CLI path invokes an XSL transformation that could be abused, though the flaw does not affect standard validation or the library’s common policy-check usage that relies on Schematron syntax rather than direct XSLT. The vulnerability is tracked as CWE-611 and carries a CVSS 4.0 score of 2.3.

An attacker would need to supply a malicious custom policy file containing XSLT to a user who then processes it on the CLI; successful exploitation could permit arbitrary code execution on the victim system. The attack requires user interaction and is limited to those who deliberately load untrusted custom XSLT-based profiles, which the project states is uncommon.

The GitHub security advisory GHSA-4cx5-89vm-833x confirms the issue is still unpatched. It recommends that users load custom policy files only from trusted sources and avoid untrusted XSLT content until a fix is released. The associated EPSS values (current 0.1249, peak 0.1682) have not shown a pronounced climb from a low baseline.