Skip to main content
Exploitation reportedNot in CISA KEV yetFix available

CVE-2025-54988

Exploitation reported by one source. First attested on 2026-10-28 by GCVE · previdian.

  • Published2025-08-20
  • Fixed in2.0.0-ALPHA
  • WeaknessCWE-611

Am I affected?

With a domain, we read the version its public headers and pages expose. A distribution build can carry the fix under an older number.

Description

Critical XXE in Apache Tika (tika-parser-pdf-module) in Apache Tika 1.13 through and including 3.2.1 on all platforms allows an attacker to carry out XML External Entity injection via a crafted XFA file inside of a PDF. An attacker may be able to read sensitive data or trigger malicious requests to internal resources or third-party servers. Note that the tika-parser-pdf-module is used as a dependency in several Tika packages including at least: tika-parsers-standard-modules, tika-parsers-standard-package, tika-app, tika-grpc and tika-server-standard. Users are recommended to upgrade to version 3.2.2, which fixes this issue.

Timeline

dates in UTC
  1. 2025-08-2020:15CVE publishedNVD
  2. 2026-10-2816:18Listed as exploited by GCVEGCVE
  3. 2026-10-2816:18Exploitation first reportedGCVE

Versions per branch

OSV · NVD
tika-parsers
BranchAffectedFixed in
2.0≥ 1.13, < 2.0.0-ALPHA2.0.0-ALPHA
Apache tika
BranchAffectedFixed in
3.2≥ 1.13, < 3.2.23.2.2

as publishedRanges as NVD and OSV publish them; a distribution’s build can be fixed under an older number.

Products declared by the CNA1 product

As apache, the CNA that assigned this CVE, declared them in the CVE record; versions as written.

  • Apache Software Foundation Apache Tika PDF parser moduleother versions: not affected

    package org.apache.tika:tika-parser-pdf-modulehttps://repo.maven.apache.org/maven2

    Affected
    • ≥ 1.13, ≤ 3.2.1no fix statedsemver

Source: the CNA record (CVE Program), © The MITRE Corporation,CVE Terms of UseCVE recordupdated 2025-09-02

Distribution builds and vendor advisories

Packages from OSV.dev and products from the vendors' CSAF advisories.

version not verifiedVersions not verified: read as OSV.dev and the vendors publish them, not checked against each vendor's release list.

Packages

  • apache-tika-2.9Chainguardall versions · no fixed version listedand 6 other packages
  • apache-tika-3.0MinimOSall versions · fixed in 3.0.0-r5and 1 other package
  • apache-tika-3.1Wolfiall versions · no fixed version listed
  • apache-tika-3.1MinimOSall versions · fixed in 3.1.0-r5and 1 other package
  • elasticsearch-8.15MinimOSall versions · no fixed version listedand 6 other packages
  • elasticsearch-8.17Chainguardall versions · fixed in 8.17.10-r1and 1 other package
  • elasticsearch-9.1MinimOSall versions · fixed in 9.1.4-r0and 2 other packages
  • elasticsearch-fips-9.0Chainguardall versions · fixed in 9.0.8-r0and 2 other packages

22 more package ranges on OSV.dev

Vendor advisories

  • CVE-2025-54988 Red Hat Product Security

    org.apache.tika/tika-parser-pdf-module: Apache Tika PDF parser module: XXE vulnerability in PDFParser's handling of XFA

Full record on NVD

Fix

  1. Update tika-parsers to 2.0.0-ALPHA

Advisories and patches

Detection

read 2026-11-01 01:02 UTC
Nuclei template
available
ProjectDiscovery
Exploit-DB
no entry
Exploit-DB
Proof of concept
Metasploit modules
1 moduleauxiliary/scanner/http/elasticsearch_tika_xfa_xxerank: normalModule metadata: Metasploit Framework, © Rapid7, Inc., BSD-3-Clause.
Metasploit Framework

Sources

Identifiers

Technical details

CVSS v3 Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Published
2025-08-20
Last Modified
2026-06-17
NVD status
Modified
GitHub Advisory
GHSA-p72g-pv48-7w9x

Frequently asked questions

What is CVE-2025-54988?

Critical XXE in Apache Tika (tika-parser-pdf-module) in Apache Tika 1.13 through and including 3.2.1 on all platforms allows an attacker to carry out XML External Entity injection via a crafted XFA file inside of a PDF. An attacker may be able to read sensitive data or trigger malicious requests to internal resources or third-party servers. Note that the tika-parser-pdf-module is used as a dependency in several Tika packages including at least: tika-parsers-standard-modules, tika-parsers-standard-package, tika-app, tika-grpc and tika-server-standard. Users are recommended to upgrade to version 3.2.2, which fixes this issue.

Is CVE-2025-54988 actively exploited?

A proof-of-concept exploit exists for CVE-2025-54988, but active exploitation has not been confirmed at this time.

What is the CVSS score for CVE-2025-54988?

CVE-2025-54988 has a CVSS v3 base score of 8.4 (HIGH severity), with vector string CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

Running tika-parsers? Hear about its next vulnerability

Surveillance reads the versions in your stack — a domain, a lockfile or a list — checks each CVE against the ranges its sources publish, and alerts you when one you run is exploited or enters CISA KEV. A version it cannot read stays « version not verified ».

Get alerts for this productCISA KEV additions, November 2026Search CVEs

No credit card required · No monthly cap on website lookups · 250 API requests/month

Go further

Related vulnerabilities

Same product first, then the same vendor advisory and the same publication week.

Back to CVE Database

Sources for this record