CVE-2025-54988

🗓️ 20 Aug 2025 23:42:07Reported by redhat.comType

redhatcve🔗 access.redhat.com👁 14 Views

CVE-2025-54988: XML entity injection in Tika parser; data access or requests; mitigation unavailable.

Reporter	Title	Published	Views	Family All 211
IBM Security Bulletins	Security Bulletin: Impacted IBM Optim 1.0.0 and 1.1.0 by vulnerabilities in Apache Tika PDF parser module	21 Sep 202611:18	–	ibm
IBM Security Bulletins	Security Bulletin: IBM SPSS Analytic Server is affected by XML External Entity injection vulnerability in Apache Tika (CVE-2025-54988)	27 Jan 202609:03	–	ibm
IBM Security Bulletins	Security Bulletin: Due to use of Apache Tika, IBM Operations Analytics - Log Analysis is affected by XML External Entity (XXE) vulnerability	7 Apr 202617:07	–	ibm
IBM Security Bulletins	Security Bulletin: Critical XXE Vulnerability in Apache Tika Affecting Content Collector for Email, File Systems, and Microsoft SharePoint (CVE-2025-54988)	22 Jun 202607:28	–	ibm
IBM Security Bulletins	Security Bulletin: IBM InfoSphere Information Server is affected by multiple vulnerabilities in Apache Tika	3 Apr 202616:00	–	ibm
IBM Security Bulletins	Security Bulletin: IBM SPSS Modeler is affected by multiple vulnerabilities in Apache Tika Core and Parsers (CVE-2025-54988, CVE-2025-66516, CVE-2025-66516)	17 Apr 202605:25	–	ibm
IBM Security Bulletins	Security Bulletin: IBM OpenPages for Cloud Pak for Data is Vulnerable to Critical XXE in Apache Tika (CVE-2025-54988)	17 Feb 202607:33	–	ibm
IBM Security Bulletins	Security Bulletin: Astronomer with IBM is vulnerable to sensitive data leaks or malicious requests due to the Apache tika package (CVE-2025-54988)	28 Nov 202519:15	–	ibm
IBM Security Bulletins	Security Bulletin: IBM OpenPages fixes Apache Tika library vulnerability via XML External Entity injection	18 Nov 202517:59	–	ibm
GithubExploit	Exploit for CVE-2025-66516	8 Dec 202510:50	–	githubexploit

Source	Link
cve	www.cve.org/CVERecord
nvd	www.nvd.nist.gov/vuln/detail/CVE-2025-54988
lists	www.lists.apache.org/thread/8xn3rqy6kz5b3l1t83kcofkw0w4mmj1w
bugzilla	www.bugzilla.redhat.com/show_bug.cgi

27 Aug 2025 03:50Current

6.2Medium risk

Vulners AI Score6.2

CVSS 3.19.4 - 9.8

EPSS0.37713

SSVC

apache tika xml entity injection tika parser portable document format module data access internal resources third party requests mitigation unavailable