CVE-2025-54988

CVE Enrichment

CVSS: 8.4 HIGH
EPSS: 48.52%
EPSS Percentile: 98.84%
CISA KEV: Not listed

Description

Critical XXE in Apache Tika (tika-parser-pdf-module) in Apache Tika 1.13 through and including 3.2.1 on all platforms allows an attacker to carry out XML External Entity injection via a crafted XFA file inside of a PDF. An attacker may be able to read sensitive data or trigger malicious requests to internal resources or third-party servers. Note that the tika-parser-pdf-module is used as a dependency in several Tika packages including at least: tika-parsers-standard-modules, tika-parsers-standard-package, tika-app, tika-grpc and tika-server-standard. Users are recommended to upgrade to version 3.2.2, which fixes this issue.

Technical Details

CVSS Version: 3.1
CNA / NVD Source: security@apache.org
Published: 21-Aug-2025 03:15
Last Modified: 17-Jun-2026 16:41
EPSS Date: 2026-10-12
CWE: CWE-611

CVSS Vector


            CVSS:3.1                            AV:L /
                            AC:L /
                            PR:N /
                            UI:N /
                            S:U /
                            C:H /
                            I:H /
                            A:H

Affected Products / Versions

apache / tika
Version / affected range: * · from (inclusive) 1.13 · before (exclusive) 3.2.2
cpe:2.3:a:apache:tika:*:*:*:*:*:*:*:*

References

Last enrichment sync: 13-Oct-2026 00:27
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.

Reported Context (1)

Description: Adds an auxiliary scanner module for CVE-2025-54988/CVE-2025-66516. The module validates an XML External Entity (XXE) vulnerability in Apache Tika's XFA parser exposed through the Elasticsearch attachment Metasploit 6.5.4 Adds 16 Modules, Including Exploits for Five CISA KEV Vulnerabilities

CVE (12)

People (17)

Products (13)

Tools (1)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.