CVE-2024-52800

veraPDF is an open source PDF/A validation library. Executing policy checks using custom schematron files via the CLI invokes an XSL transformation that may theoretically lead to a remote code execution (RCE) vulnerability. This doesn't affect the standard validation and policy checks functionality, veraPDF's common use cases. Most veraPDF users don't insert any custom XSLT code into policy profiles, which are based on Schematron syntax rather than direct XSL transforms. For users who do, only load custom policy files from sources you trust. This issue has not yet been patched. Users are advised to be cautious of XSLT code until a patch is available.

• CWE-611

• https://github.com/veraPDF/veraPDF-library/issues/1488
• https://github.com/veraPDF/veraPDF-library/security/advisories/GHSA-4cx5-89vm-833x

Published

Nov 29, 2024

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-52794Discourse is an open source platform for community discussio…6.1
• CVE-2024-52796Password Pusher, an open source application to communicate s…5.3
• CVE-2024-52797Opencast is free and open source software for automated vide…7.5
• CVE-2024-52798path-to-regexp turns path strings into a regular expressions…7.7
• CVE-2024-52799Argo Workflows Chart is used to set up argo and its needed d…8.2
• CVE-2024-5280The wp-affiliate-platform WordPress plugin before 6.5.1 does…4.7
• CVE-2024-52801sftpgo is a full-featured and highly configurable event-driv…5.3
• CVE-2024-52802RIOT is an operating system for internet of things (IoT) dev…7.5
• CVE-2024-52803LLama Factory enables fine-tuning of large language models. …9.8
• CVE-2024-52804Tornado is a Python web framework and asynchronous networkin…7.5
• CVE-2024-52805Synapse is an open-source Matrix homeserver. In Synapse befo…7.5
• CVE-2024-52806SimpleSAMLphp SAML2 library is a PHP library for SAML2 relat…8.3