CVE-2025-53689
Apache Jackrabbit: XXE vulnerability in jackrabbit-spi-commons
CVE-2025-53689 is a high vulnerability (CVSS 8.8) in Apache Jackrabbit, published July 14, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.54%, the 45th percentile. Fixed in org.apache.jackrabbit:jackrabbit-spi-commons 2.20.17.
Blind XXE Vulnerabilities in jackrabbit-spi-commons and jackrabbit-core in Apache Jackrabbit < 2.23.2 due to usage of an unsecured document build to load privileges.
Users are recommended to upgrade to versions 2.20.17 (Java 8), 2.22.1 (Java 11) or 2.23.2 (Java 11, beta versions), which fix this issue. Earlier versions (up to 2.20.16) are not supported anymore, thus users should update to the respective supported version.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Apache Jackrabbit: XXE vulnerability in jackrabbit-spi-commons
Blind XXE Vulnerabilities in jackrabbit-spi-commons and jackrabbit-core in Apache Jackrabbit < 2.23.2 due to usage of an unsecured document build to load privileges.
Users are recommended to upgrade to versions 2.20.17 (Java 8), 2.22.1 (Java 11) or 2.23.2 (Java 11, beta versions), which fix this issue. Earlier versions (up to 2.20.16) are not supported anymore, thus users should update to the respective supported version.
- Record
CVE-2025-53689- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-611
- Updated
- 2026-11-02
EUVDEUVD-2025-21327
Blind XXE Vulnerabilities in jackrabbit-spi-commons and jackrabbit-core in Apache Jackrabbit < 2.23.2 due to usage of an unsecured document build to load privileges.
Users are recommended to upgrade to versions 2.20.17 (Java 8), 2.22.1 (Java 11) or 2.23.2 (Java 11, beta versions), which fix this issue. Earlier versions (up to 2.20.16) are not supported anymore, thus users should update to the respective supported version.
- Record
EUVD-2025-21327- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-44c3-38h8-9fh9
Apache Jackrabbit vulnerable to blind XXE attack due to insecure document build
Blind XXE vulnerabilities in jackrabbit-spi-commons and jackrabbit-core in Apache Jackrabbit < 2.23.2 due to usage of an unsecured document build to load privileges.
Users are recommended to upgrade to versions 2.20.17 (Java 8), 2.22.1 (Java 11) or 2.23.2 (Java 11, beta versions), which fix this issue. Earlier versions (up to 2.20.16) are not supported anymore, thus users should update to the respective supported version.
- Record
GHSA-44c3-38h8-9fh9- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-611
- Updated
- 2026-11-02
NVD
Blind XXE Vulnerabilities in jackrabbit-spi-commons and jackrabbit-core in Apache Jackrabbit < 2.23.2 due to usage of an unsecured document build to load privileges.
Users are recommended to upgrade to versions 2.20.17 (Java 8), 2.22.1 (Java 11) or 2.23.2 (Java 11, beta versions), which fix this issue. Earlier versions (up to 2.20.16) are not supported anymore, thus users should update to the respective supported version.
- Record
CVE-2025-53689- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-611
- Updated
- 2026-11-02
OSV
Apache Jackrabbit: XXE vulnerability in jackrabbit-spi-commons
Blind XXE Vulnerabilities in jackrabbit-spi-commons and jackrabbit-core in Apache Jackrabbit < 2.23.2 due to usage of an unsecured document build to load privileges.
Users are recommended to upgrade to versions 2.20.17 (Java 8), 2.22.1 (Java 11) or 2.23.2 (Java 11, beta versions), which fix this issue. Earlier versions (up to 2.20.16) are not supported anymore, thus users should update to the respective supported version.
- Record
CVE-2025-53689- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-611
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2025-53689
Blind XXE Vulnerabilities in jackrabbit-spi-commons and jackrabbit-core in Apache Jackrabbit < 2.23.2 due to usage of an unsecured document build to load privileges. Users are recommended to upgrade to versions 2.20.17 (Java 8), 2.22.1 (Java 11) or 2.23.2 (Java 11, beta versions), which fix this issue. Earlier versions (up to 2.20.16) are not supported anymore, thus users should update to the respective supported version.
- Record
DEBIAN-CVE-2025-53689- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVGHSA-44c3-38h8-9fh9
Apache Jackrabbit vulnerable to blind XXE attack due to insecure document build
Blind XXE vulnerabilities in jackrabbit-spi-commons and jackrabbit-core in Apache Jackrabbit < 2.23.2 due to usage of an unsecured document build to load privileges.
Users are recommended to upgrade to versions 2.20.17 (Java 8), 2.22.1 (Java 11) or 2.23.2 (Java 11, beta versions), which fix this issue. Earlier versions (up to 2.20.16) are not supported anymore, thus users should update to the respective supported version.
- Record
GHSA-44c3-38h8-9fh9- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-611
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2025-53689
Blind XXE Vulnerabilities in jackrabbit-spi-commons and jackrabbit-core in Apache Jackrabbit < 2.23.2 due to usage of an unsecured document build to load privileges. Users are recommended to upgrade to versions 2.20.17 (Java 8), 2.22.1 (Java 11) or 2.23.2 (Java 11, beta versions), which fix this issue. Earlier versions (up to 2.20.16) are not supported anymore, thus users should update to the respective supported version.
- Record
UBUNTU-CVE-2025-53689- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.apache.jackrabbit:jackrabbit-spi-commonsMaven |
2.20.0 up to 2.20.17 | 2.20.17 |
org.apache.jackrabbit:jackrabbit-spi-commonsMaven |
2.22.0 up to 2.22.1 | 2.22.1 |
org.apache.jackrabbit:jackrabbit-spi-commonsMaven |
2.23.0-beta up to 2.23.2-beta | 2.23.2-beta |
org.apache.jackrabbit:jackrabbit-coreMaven |
2.23.0-beta up to 2.23.2-beta | 2.23.2-beta |
org.apache.jackrabbit:jackrabbit-coreMaven |
2.20.0 up to 2.20.17 | 2.20.17 |
org.apache.jackrabbit:jackrabbit-coreMaven |
2.22.0 up to 2.22.1 | 2.22.1 |
jackrabbitDebian:12 |
All versions, plus listed versions 2.20.11-12.20.11-1.12.20.3-1 |
None known |
jackrabbitDebian:13 |
before 2.20.11-1.1 | 2.20.11-1.1 |
jackrabbitDebian:14 |
before 2.20.11-1.1 | 2.20.11-1.1 |
org.apache.jackrabbit:jackrabbit-spi-commonsMaven |
2.20.0 up to 2.20.17, plus listed versions 2.20.12.20.102.20.112.20.122.20.13 Show 11 moreShow less2.20.142.20.152.20.162.20.22.20.32.20.42.20.52.20.62.20.72.20.82.20.9 |
2.20.17 |
Show 12 moreShow less
| Package | Affected | Fixed |
|---|---|---|
org.apache.jackrabbit:jackrabbit-spi-commonsMaven |
2.23.0-beta up to 2.23.2-beta, plus listed versions 2.23.1-beta |
2.23.2-beta |
org.apache.jackrabbit:jackrabbit-coreMaven |
2.23.0-beta up to 2.23.2-beta, plus listed versions 2.23.1-beta |
2.23.2-beta |
org.apache.jackrabbit:jackrabbit-coreMaven |
2.20.0 up to 2.20.17, plus listed versions 2.20.12.20.102.20.112.20.122.20.13 Show 11 moreShow less2.20.142.20.152.20.162.20.22.20.32.20.42.20.52.20.62.20.72.20.82.20.9 |
2.20.17 |
jackrabbitUbuntu:14.04:LTS |
All versions, plus listed versions 2.3.6-12.3.6-1+deb8u1build0.14.04.12.3.6-1+deb8u2build0.14.04.1 |
None known |
jackrabbitUbuntu:16.04:LTS |
All versions, plus listed versions 2.10.1-12.10.1-2 |
None known |
jackrabbitUbuntu:18.04:LTS |
All versions, plus listed versions 2.12.6-12.14.4-1 |
None known |
jackrabbitUbuntu:20.04:LTS |
All versions, plus listed versions 2.18.0+r2.14.6-1 |
None known |
jackrabbitUbuntu:22.04:LTS |
All versions, plus listed versions 2.18.0+r2.14.6-12.20.3-1 |
None known |
jackrabbitUbuntu:24.04:LTS |
All versions, plus listed versions 2.20.11-1 |
None known |
jackrabbitUbuntu:25.10 |
All versions, plus listed versions 2.20.11-12.20.11-1.1 |
None known |
jackrabbitUbuntu:26.10 |
All versions, plus listed versions 2.20.11-1.1 |
None known |
jackrabbitUbuntu:26.04:LTS |
All versions, plus listed versions 2.20.11-1.1 |
None known |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-02 | created | CVE List, EUVD, GitHub Advisories, NVD, OSV |
References
lists.apache.org/thread/5pf9n76ny13pzzk765og2h3gxdxw7p24
openwall.com/lists/oss-security/2025/07/14/1
nvd.nist.gov/vuln/detail/CVE-2025-53689
github.com/apache/jackrabbit/pull/263/commits/02786c0a01838580252bdab79bfa54026c30294e