{"id":"CVE-2025-54988","published":"2025-08-20T20:08:49Z","modified":"2026-02-26T17:48:22Z","title":"Apache Tika PDF parser module: XXE vulnerability in PDFParser's handling of XFA","vendor":"Apache Software Foundation","product":"Apache Tika PDF parser module","tier":"core","eol":null,"affectedVersions":[{"vendor":"Apache Software Foundation","product":"Apache Tika PDF parser module","versions":[">= 1.13, <= 3.2.1"]}],"description":{"text":"Critical XXE in Apache Tika (tika-parser-pdf-module) in Apache Tika 1.13 through and including 3.2.1 on all platforms allows an attacker to carry out XML External Entity injection via a crafted XFA file inside of a PDF. An attacker may be able to read sensitive data or trigger malicious requests to internal resources or third-party servers. Note that the tika-parser-pdf-module is used as a dependency in several Tika packages including at least: tika-parsers-standard-modules, tika-parsers-standard-package, tika-app, tika-grpc and tika-server-standard.\n\nUsers are recommended to upgrade to version 3.2.2, which fixes this issue.","provenance":"source","from":"CVE.org"},"summary":{"text":"The Apache Tika PDF parser module (tika-parser-pdf-module) contains an XML External Entity injection flaw in how PDFParser handles XFA content inside PDF files, affecting releases from 1.13 through 3.2.1 on all platforms. An attacker who supplies a crafted PDF containing a malicious XFA file can cause the parser to process external entities, potentially reading sensitive data or triggering requests to internal resources or third-party servers, with no authentication or user interaction required.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:53:59Z"},"cvss":{"score":8.4,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.47948,"percentile":0.98852,"date":"2026-10-29","provenance":"source"},"kev":null,"vulncheckKev":{"dateAdded":"2026-10-28","exploitedFirstSeen":"2026-10-28","ransomware":false,"evidence":[{"url":"https://previdian.com/CVE-2025-54988","date":"2026-10-28"}],"evidenceTotal":1,"provenance":"source"},"exploited":true,"otx":{"pulseCount":1,"pulses":[{"name":"Actualización Apache update - 25/08/2025","url":"https://otx.alienvault.com/pulse/68acc5e07fc9dd6ca3ac2b17","created":"2025-08-25"}],"provenance":"machine"},"cwes":[{"id":"CWE-611","name":"Improper Restriction of XML External Entity Reference"}],"references":[{"url":"https://lists.apache.org/thread/8xn3rqy6kz5b3l1t83kcofkw0w4mmj1w","tags":["vendor-advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2025/10/msg00030.html","tags":[]},{"url":"http://www.openwall.com/lists/oss-security/2025/08/20/2","tags":[]},{"url":"http://www.openwall.com/lists/oss-security/2025/08/20/3","tags":[]}],"techniques":[],"reports":[],"affected":[{"ecosystem":"Maven","package":"org.apache.tika:tika-parser-pdf-module","vulnerableRanges":[">=1.13, <3.2.2"],"patched":["3.2.2"],"from":["GHSA-p72g-pv48-7w9x"],"provenance":"source"},{"ecosystem":"Maven","package":"org.apache.tika:tika-parsers","vulnerableRanges":[">=1.13, <2.0.0-ALPHA"],"patched":["2.0.0-ALPHA"],"from":["GHSA-p72g-pv48-7w9x"],"provenance":"source"}],"advisories":[{"id":"GHSA-p72g-pv48-7w9x","url":"https://github.com/advisories/GHSA-p72g-pv48-7w9x","severity":"CRITICAL","ecosystem":"Maven","package":"org.apache.tika:tika-parser-pdf-module","vulnerableRanges":[">=1.13, <3.2.2"],"patched":["3.2.2"],"provenance":"source","from":"GHSA"},{"id":"GHSA-p72g-pv48-7w9x","url":"https://github.com/advisories/GHSA-p72g-pv48-7w9x","severity":"CRITICAL","ecosystem":"Maven","package":"org.apache.tika:tika-parsers","vulnerableRanges":[">=1.13, <2.0.0-ALPHA"],"patched":["2.0.0-ALPHA"],"provenance":"source","from":"GHSA"}],"euvd":{"id":"EUVD-2025-25435","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-25435","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":2,"skipped":0,"earliest":"2025-09-04","earliestUrl":"https://github.com/mgthuramoemyint/POC-CVE-2025-54988","repos":[{"name":"mgthuramoemyint/POC-CVE-2025-54988","url":"https://github.com/mgthuramoemyint/POC-CVE-2025-54988","stars":20,"created":"2025-09-04"},{"name":"galoryber/cve-2025-54988-VulnTikaProject","url":"https://github.com/galoryber/cve-2025-54988-VulnTikaProject","stars":0,"created":"2025-12-17"}]},"metasploit":[{"name":"Elasticsearch ingest-attachment Apache Tika XFA XXE Local File Read","module":"auxiliary/scanner/http/elasticsearch_tika_xfa_xxe","type":"auxiliary","disclosureDate":"2025-08-20","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/http/elasticsearch_tika_xfa_xxe.rb"}],"nuclei":[{"id":"CVE-2025-54988","name":"Apache Tika - XXE Injection","severity":"critical","path":"http/cves/2025/CVE-2025-54988.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-54988.yaml"}],"first":{"date":"2025-08-20","source":"Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/http/elasticsearch_tika_xfa_xxe.rb"},"provenance":"source"},"exploitRefs":[],"flow":[],"timeline":[{"date":"2025-08-20","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2025-54988","provenance":"source"},{"date":"2025-08-20","kind":"exploit-public","label":"First public exploit: Metasploit; later: PoC-in-GitHub 2025-09-04","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/http/elasticsearch_tika_xfa_xxe.rb","provenance":"source"},{"date":"2026-10-28","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://previdian.com/CVE-2025-54988","provenance":"source"}],"speed":{"daysToPublicExploit":0,"firstExploitFrom":"Metasploit","daysToKev":null},"priority":{"score":76.3,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in VulnCheck KEV"},{"name":"Recent KEV listing","points":10.0,"detail":"added 2 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.77,"detail":"percentile 0.9885"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"2 PoC-in-GitHub repos; 1 Metasploit module; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":0.68,"detail":"1 pulse"},{"name":"CVSS severity","points":5.88,"detail":"base score 8.4"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]},"lineage":{"familyId":"fam-apache-tika-pdf-parser-module-cve-2025-54988","children":[{"from":"CVE-2025-54988","to":"CVE-2025-66516","relation":"successor","confidence":"high","kind":"lineage","evidence":[{"kind":"text","provenance":"source","relation":"related","quote":"This CVE covers the same vulnerability as in CVE-2025-54988.","from":"CVE.org","in":"CVE-2025-66516"},{"kind":"osv-related","provenance":"source","id":"GHSA-f58c-gq56-vjjf","via":"reference","url":"https://cve.org/CVERecord?id=CVE-2025-54988"},{"kind":"version-step","provenance":"source","package":"Maven:org.apache.tika:tika-parsers","fromFixed":"2.0.0-ALPHA","toFixed":"2.0.0","daysApart":106},{"kind":"similar","provenance":"machine","score":0.72,"basis":"same package + description similarity"}]}],"packageHistory":[{"cve":"CVE-2018-1339","published":"2018-04-25","fixed":"1.18","kev":false},{"cve":"CVE-2018-17197","published":"2018-12-24","fixed":"1.20","kev":false},{"cve":"CVE-2019-10093","published":"2019-08-02","fixed":"1.22","kev":false},{"cve":"CVE-2025-54988","published":"2025-08-20","fixed":"2.0.0-ALPHA","kev":false},{"cve":"CVE-2025-66516","published":"2025-12-04","fixed":"2.0.0","kev":false}],"package":"Maven:org.apache.tika:tika-parsers"}}