The vulnerabilities of the tika-core, tika-pdf-module, and tika-parsers modules in the Apache Tika content discovery and analysis framework allow attackers to perform XXE attacks.

🗓️ 28 Jan 2026 00:00:00Reported by FSTEC of Russia — Information Security Threat DatabaseType

Vulnerabilities in tika-core, tika-pdf-module, and tika-parsers allow XML external entity attacks via improper external-link limits in PDFs with XML Form Architecture files.

Reporter	Title	Published	Views	Family All 211
IBM Security Bulletins	Security Bulletin: Impacted IBM Optim 1.0.0 and 1.1.0 by vulnerabilities in Apache Tika PDF parser module	21 Sep 202611:18	–	ibm
IBM Security Bulletins	Security Bulletin: IBM SPSS Analytic Server is affected by XML External Entity injection vulnerability in Apache Tika (CVE-2025-54988)	27 Jan 202609:03	–	ibm
IBM Security Bulletins	Security Bulletin: Due to use of Apache Tika, IBM Operations Analytics - Log Analysis is affected by XML External Entity (XXE) vulnerability	7 Apr 202617:07	–	ibm
IBM Security Bulletins	Security Bulletin: Critical XXE Vulnerability in Apache Tika Affecting Content Collector for Email, File Systems, and Microsoft SharePoint (CVE-2025-54988)	22 Jun 202607:28	–	ibm
IBM Security Bulletins	Security Bulletin: IBM InfoSphere Information Server is affected by multiple vulnerabilities in Apache Tika	3 Apr 202616:00	–	ibm
IBM Security Bulletins	Security Bulletin: IBM SPSS Modeler is affected by multiple vulnerabilities in Apache Tika Core and Parsers (CVE-2025-54988, CVE-2025-66516, CVE-2025-66516)	17 Apr 202605:25	–	ibm
IBM Security Bulletins	Security Bulletin: IBM OpenPages for Cloud Pak for Data is Vulnerable to Critical XXE in Apache Tika (CVE-2025-54988)	17 Feb 202607:33	–	ibm
IBM Security Bulletins	Security Bulletin: Astronomer with IBM is vulnerable to sensitive data leaks or malicious requests due to the Apache tika package (CVE-2025-54988)	28 Nov 202519:15	–	ibm
IBM Security Bulletins	Security Bulletin: IBM OpenPages fixes Apache Tika library vulnerability via XML External Entity injection	18 Nov 202517:59	–	ibm
GithubExploit	Exploit for CVE-2025-66516	8 Dec 202510:50	–	githubexploit

Vulners

Node

apache tika_coreRange1.13–3.2.1

apache tika_parsersRange1.13–2.0.0

apache tika_pdfRange2.0.0–3.2.1

Source	Link
lists	www.lists.apache.org/thread/8xn3rqy6kz5b3l1t83kcofkw0w4mmj1w
lists	www.lists.apache.org/thread/s5x3k93nhbkqzztp1olxotoyjpdlps9k
openwall	www.openwall.com/lists/oss-security/2025/08/20/2
openwall	www.openwall.com/lists/oss-security/2025/08/20/3
lists	www.lists.debian.org/debian-lts-announce/2025/10/msg00030.html
security-tracker	www.security-tracker.debian.org/tracker/CVE-2025-54988
xakep	www.xakep.ru/2025/12/08/tika-xxe/
web	www.web.nvd.nist.gov/view/vuln/detail

28 Jan 2026 00:00Current

7.4High risk

Vulners AI Score7.4

CVSS 39.8

CVSS 210

EPSS0.37713