diff --git a/scripts/sync.py b/scripts/sync.py
index 353d5cc9..372d3283 100644
--- a/scripts/sync.py
+++ b/scripts/sync.py
@@ -99,8 +99,14 @@ def parse_archive(path, since_year):
             if len(raw) != member.size or len(raw)>MAX_MEMBER:
                 raise ValueError(f'Incomplete JSON: {member.name}')
             obj=json.loads(raw)
-            if not isinstance(obj,dict) or not isinstance(obj.get('document'),dict) or not isinstance(obj.get('vulnerabilities'),list):
-                raise ValueError(f'Invalid CSAF document: {member.name}')
+            if not isinstance(obj, dict) or not isinstance(obj.get('document'), dict):
+                raise ValueError(f'Missing CSAF document object: {member.name}')
+            # CSAF Base allows vulnerabilities to be omitted. A strict VEX-profile
+            # check would require it, but the upstream archive also contains
+            # document-only files. Preserve raw upstream files without claiming
+            # those files individually conform to the VEX profile.
+            if 'vulnerabilities' in obj and not isinstance(obj['vulnerabilities'], list):
+                raise ValueError(f'Invalid vulnerabilities field: {member.name}')
             year=match.group(1)
             cve=f'CVE-{year}-{match.group(2)}'
             # Duplicate names across archive: only exact duplicate bytes are acceptable