Apache Tika XXE Vulnerability via Crafted XFA File Inside a PDF

🗓️ 20 Aug 2025 21:30:27Reported by GitHub Advisory DatabaseType

Critical XXE in Apache Tika crafted XFA in PDF; tika-parser-pdf-module 1.13–3.2.1; upgrade to 3.2.2

Reporter	Title	Published	Views	Family All 211
IBM Security Bulletins	Security Bulletin: Impacted IBM Optim 1.0.0 and 1.1.0 by vulnerabilities in Apache Tika PDF parser module	21 Sep 202611:18	–	ibm
IBM Security Bulletins	Security Bulletin: IBM SPSS Analytic Server is affected by XML External Entity injection vulnerability in Apache Tika (CVE-2025-54988)	27 Jan 202609:03	–	ibm
IBM Security Bulletins	Security Bulletin: Due to use of Apache Tika, IBM Operations Analytics - Log Analysis is affected by XML External Entity (XXE) vulnerability	7 Apr 202617:07	–	ibm
IBM Security Bulletins	Security Bulletin: Critical XXE Vulnerability in Apache Tika Affecting Content Collector for Email, File Systems, and Microsoft SharePoint (CVE-2025-54988)	22 Jun 202607:28	–	ibm
IBM Security Bulletins	Security Bulletin: IBM InfoSphere Information Server is affected by multiple vulnerabilities in Apache Tika	3 Apr 202616:00	–	ibm
IBM Security Bulletins	Security Bulletin: IBM SPSS Modeler is affected by multiple vulnerabilities in Apache Tika Core and Parsers (CVE-2025-54988, CVE-2025-66516, CVE-2025-66516)	17 Apr 202605:25	–	ibm
IBM Security Bulletins	Security Bulletin: IBM OpenPages for Cloud Pak for Data is Vulnerable to Critical XXE in Apache Tika (CVE-2025-54988)	17 Feb 202607:33	–	ibm
IBM Security Bulletins	Security Bulletin: Astronomer with IBM is vulnerable to sensitive data leaks or malicious requests due to the Apache tika package (CVE-2025-54988)	28 Nov 202519:15	–	ibm
IBM Security Bulletins	Security Bulletin: IBM OpenPages fixes Apache Tika library vulnerability via XML External Entity injection	18 Nov 202517:59	–	ibm
GithubExploit	Exploit for CVE-2025-66516	8 Dec 202510:50	–	githubexploit

Vulners

Node

org.apache.tika tika-parsersRange1.13–2.0.0-ALPHAmaven

org.apache.tika tika-parser-pdf-moduleRange1.13–3.2.2maven

Source	Link
nvd	www.nvd.nist.gov/vuln/detail/CVE-2025-54988
lists	www.lists.apache.org/thread/8xn3rqy6kz5b3l1t83kcofkw0w4mmj1w
github	www.github.com/apache/tika/pull/2291
github	www.github.com/apache/tika/commit/2b52257304f4d3cde2b8463657380bdb936d9ef2
archive	www.archive.apache.org/dist/tika/3.2.2/CHANGES-3.2.2.txt
issues	www.issues.apache.org/jira/browse/TIKA-4459
lists	www.lists.apache.org/thread/stn9oh7rfn9yv76n1srxr9w56oy04p72
lists	www.lists.debian.org/debian-lts-announce/2025/10/msg00030.html
openwall	www.openwall.com/lists/oss-security/2025/08/20/2
openwall	www.openwall.com/lists/oss-security/2025/08/20/3

05 Nov 2025 20:40Current

7.1High risk

Vulners AI Score7.1

CVSS 3.18.4 - 9.8

EPSS0.36847

SSVC

CWE-611