PT-2025-34153 · Apache+2 · Tika-Parsers-Standard-Package+9

Paras Jain + 1 · Published 2025-08-20 · Updated 2026-05-27 · CVE-2025-54988

Positive Technologies (AI Summary)

CVSS v4.0

10

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Name of the Vulnerable Software and Affected Versions Apache Tika versions 1.13 through 3.2.1 Apache Tika tika-core versions 1.13 through 3.2.1 Apache Tika tika-pdf-module versions 2.0.0 through 3.2.1 Apache Tika tika-parsers versions 1.13 through 1.28.5

Description A critical XML External Entity (XXE) issue exists in Apache Tika, specifically within the tika-parser-pdf-module, tika-core, and tika-parsers components. This flaw allows an attacker to inject malicious XML code via a crafted XFA file embedded within a PDF document. Successful exploitation could enable an attacker to read sensitive data or initiate unauthorized requests to internal resources or external servers. The root cause of the vulnerability lies within the PDFParser component, initially reported in the tika-parser-pdf-module but ultimately fixed in tika-core. The vulnerability affects versions 1.x where the PDFParser resides in the org.apache.tika:tika-parsers module.

Recommendations Upgrade to Apache Tika version 3.2.2 or later. Upgrade tika-core to version 3.2.2 or later. Upgrade tika-pdf-module to version 3.2.2 or later. Upgrade tika-parsers to version 1.28.5 or later.

Fix

RCE

XXE

Weakness Enumeration

CWE-611

Related Identifiers

BDU:2026-00894

CVE-2025-54988

DLA-4350-1

GHSA-F58C-GQ56-VJJF

GHSA-P72G-PV48-7W9X

USN-8324-1

Affected Products

Apache Tika

Bamboo

Confluence

Debian

Tika-App

Tika-Grpc

Tika-Parser-Pdf-Module

Tika-Parsers-Standard-Modules

Tika-Parsers-Standard-Package

Tika-Server-Standard

References · 61

• https://nvd.nist.gov/vuln/detail/CVE-2025-54988 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-66516 · Security Note
• https://osv.dev/vulnerability/GHSA-f58c-gq56-vjjf · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-54988 · Security Note
• https://ubuntu.com/security/notices/USN-8324-1 · Vendor Advisory
• https://lists.apache.org/thread/8xn3rqy6kz5b3l1t83kcofkw0w4mmj1w · Vendor Advisory
• https://osv.dev/vulnerability/DLA-4350-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-66516 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-54988 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-54988 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-00894 · Security Note
• https://osv.dev/vulnerability/USN-8324-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-54988 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-54988 · Security Note
• https://ubuntu.com/security/CVE-2025-54988 · Vendor Advisory