XML External Entity Injection (XXE)

🗓️ 17 Sep 2025 05:42:12Reported by Veracode Vulnerability DatabaseType

veracode🔗 sca.analysiscenter.veracode.com👁 20 Views

Tika PDF parser is vulnerable to XML External Entity injection via XFA PDFs enabling leakage.

Reporter	Title	Published	Views	Family All 212
IBM Security Bulletins	Security Bulletin: Impacted IBM Optim 1.0.0 and 1.1.0 by vulnerabilities in Apache Tika PDF parser module	21 Sep 202611:18	–	ibm
IBM Security Bulletins	Security Bulletin: IBM SPSS Analytic Server is affected by XML External Entity injection vulnerability in Apache Tika (CVE-2025-54988)	27 Jan 202609:03	–	ibm
IBM Security Bulletins	Security Bulletin: Due to use of Apache Tika, IBM Operations Analytics - Log Analysis is affected by XML External Entity (XXE) vulnerability	7 Apr 202617:07	–	ibm
IBM Security Bulletins	Security Bulletin: Critical XXE Vulnerability in Apache Tika Affecting Content Collector for Email, File Systems, and Microsoft SharePoint (CVE-2025-54988)	22 Jun 202607:28	–	ibm
IBM Security Bulletins	Security Bulletin: IBM InfoSphere Information Server is affected by multiple vulnerabilities in Apache Tika	3 Apr 202616:00	–	ibm
IBM Security Bulletins	Security Bulletin: IBM SPSS Modeler is affected by multiple vulnerabilities in Apache Tika Core and Parsers (CVE-2025-54988, CVE-2025-66516, CVE-2025-66516)	17 Apr 202605:25	–	ibm
IBM Security Bulletins	Security Bulletin: IBM OpenPages for Cloud Pak for Data is Vulnerable to Critical XXE in Apache Tika (CVE-2025-54988)	17 Feb 202607:33	–	ibm
IBM Security Bulletins	Security Bulletin: Astronomer with IBM is vulnerable to sensitive data leaks or malicious requests due to the Apache tika package (CVE-2025-54988)	28 Nov 202519:15	–	ibm
IBM Security Bulletins	Security Bulletin: IBM OpenPages fixes Apache Tika library vulnerability via XML External Entity injection	18 Nov 202517:59	–	ibm
GithubExploit	Exploit for CVE-2025-66516	8 Dec 202510:50	–	githubexploit

Vulners

Node

apache tika-parser-pdf-moduleRange2.0.0-ALPHA–3.2.1java

apache tika-parser-pdf-moduleRange1.13–3.2.1java

apache tika-parsersRange1.13–1.28.5java

Source	Link
github	www.github.com/apache/tika/pull/2291
openwall	www.openwall.com/lists/oss-security/2025/08/20/2
lists	www.lists.debian.org/debian-lts-announce/2025/10/msg00030.html
issues	www.issues.apache.org/jira/browse/TIKA-4459
archive	www.archive.apache.org/dist/tika/3.2.2/CHANGES-3.2.2.txt
lists	www.lists.apache.org/thread/stn9oh7rfn9yv76n1srxr9w56oy04p72
github	www.github.com/apache/tika/commit/2b52257304f4d3cde2b8463657380bdb936d9ef2
nvd	www.nvd.nist.gov/vuln/detail/CVE-2025-54988
openwall	www.openwall.com/lists/oss-security/2025/08/20/3
lists	www.lists.apache.org/thread/8xn3rqy6kz5b3l1t83kcofkw0w4mmj1w

08 Aug 2026 16:39Current

7High risk

Vulners AI Score7

CVSS 3.19.8

EPSS0.3666

SSVC