💡Idea of methods to add.

[righettod]

Ideas

• Add support for the detection of XFA form in a PDF file to detect attack like CVE-2025-54988.

References

• https://github.com/mgthuramoemyint/POC-CVE-2025-54988
• POC-CVE-2025-54988-main.zip
• Sample file to use
• Code snippet for the detection:

import org.apache.pdfbox.Loader;
import org.apache.pdfbox.pdmodel.PDDocument;
import org.apache.pdfbox.pdmodel.PDDocumentCatalog;
import org.apache.pdfbox.pdmodel.interactive.form.PDAcroForm;

File filePath = new File("doc-pdf-with-xxe-in-xfa-form.pdf");
try (PDDocument document = Loader.loadPDF(filePath)) {
	PDDocumentCatalog catalog = document.getDocumentCatalog();
	PDAcroForm acroForm = catalog.getAcroForm();
	boolean hasForm  = (acroForm != null && acroForm.getXFA() != null);
	System.out.println(hasForm);
}