CVE-2025-54988
Apache Tika PDF parser module: XXE vulnerability in PDFParser's handling of XFA
Critical XXE in Apache Tika (tika-parser-pdf-module) in Apache Tika 1.13 through and including 3.2.1 on all platforms allows an attacker to carry out XML External Entity injection via a crafted XFA file inside of a PDF. An attacker may be able to read sensitive data or trigger malicious requests to internal resources or third-party servers. Note that the tika-parser-pdf-module is used as a dependency in several Tika packages including at least: tika-parsers-standard-modules, tika-parsers-standard-package, tika-app, tika-grpc and tika-server-standard.
Users are recommended to upgrade to version 3.2.2, which fixes this issue.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Apache Tika PDF parser module: XXE vulnerability in PDFParser's handling of XFA
Critical XXE in Apache Tika (tika-parser-pdf-module) in Apache Tika 1.13 through and including 3.2.1 on all platforms allows an attacker to carry out XML External Entity injection via a crafted XFA file inside of a PDF. An attacker may be able to read sensitive data or trigger malicious requests to internal resources or third-party servers. Note that the tika-parser-pdf-module is used as a dependency in several Tika packages including at least: tika-parsers-standard-modules, tika-parsers-standard-package, tika-app, tika-grpc and tika-server-standard.
Users are recommended to upgrade to version 3.2.2, which fixes this issue.
- Record
CVE-2025-54988- CVSS 3.1
- 8.4 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-611
- Updated
- 2026-11-02
EUVDEUVD-2025-25435
Critical XXE in Apache Tika (tika-parser-pdf-module) in Apache Tika 1.13 through and including 3.2.1 on all platforms allows an attacker to carry out XML External Entity injection via a crafted XFA file inside of a PDF. An attacker may be able to read sensitive data or trigger malicious requests to internal resources or third-party servers. Note that the tika-parser-pdf-module is used as a dependency in several Tika packages including at least: tika-parsers-standard-modules, tika-parsers-standard-package, tika-app, tika-grpc and tika-server-standard.
Users are recommended to upgrade to version 3.2.2, which fixes this issue.
- Record
EUVD-2025-25435- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-p72g-pv48-7w9x
Apache Tika XXE Vulnerability via Crafted XFA File Inside a PDF
Critical XXE in Apache Tika (tika-parser-pdf-module) in Apache Tika 1.13 through and including 3.2.1 on all platforms allows an attacker to carry out XML External Entity injection via a crafted XFA file inside of a PDF. An attacker may be able to read sensitive data or trigger malicious requests to internal resources or third-party servers. Note that the tika-parser-pdf-module is used as a dependency in several Tika packages including at least: tika-parsers-standard-modules, tika-parsers-standard-package, tika-app, tika-grpc and tika-server-standard.
Users are recommended to upgrade to version 3.2.2, which fixes this issue.
- Record
GHSA-p72g-pv48-7w9x- CVSS 4.0
- 9.3 Critical
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N - CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-611
- Updated
- 2026-11-02
NVD
Critical XXE in Apache Tika (tika-parser-pdf-module) in Apache Tika 1.13 through and including 3.2.1 on all platforms allows an attacker to carry out XML External Entity injection via a crafted XFA file inside of a PDF. An attacker may be able to read sensitive data or trigger malicious requests to internal resources or third-party servers. Note that the tika-parser-pdf-module is used as a dependency in several Tika packages including at least: tika-parsers-standard-modules, tika-parsers-standard-package, tika-app, tika-grpc and tika-server-standard.
Users are recommended to upgrade to version 3.2.2, which fixes this issue.
- Record
CVE-2025-54988- CVSS 3.1
- 8.4 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-611
- Updated
- 2026-11-02
OSV
Apache Tika PDF parser module: XXE vulnerability in PDFParser's handling of XFA
Critical XXE in Apache Tika (tika-parser-pdf-module) in Apache Tika 1.13 through and including 3.2.1 on all platforms allows an attacker to carry out XML External Entity injection via a crafted XFA file inside of a PDF. An attacker may be able to read sensitive data or trigger malicious requests to internal resources or third-party servers. Note that the tika-parser-pdf-module is used as a dependency in several Tika packages including at least: tika-parsers-standard-modules, tika-parsers-standard-package, tika-app, tika-grpc and tika-server-standard.
Users are recommended to upgrade to version 3.2.2, which fixes this issue.
- Record
CVE-2025-54988- CVSS 3.1
- 8.4 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-611
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2025-54988
Critical XXE in Apache Tika (tika-parser-pdf-module) in Apache Tika 1.13 through and including 3.2.1 on all platforms allows an attacker to carry out XML External Entity injection via a crafted XFA file inside of a PDF. An attacker may be able to read sensitive data or trigger malicious requests to internal resources or third-party servers. Note that the tika-parser-pdf-module is used as a dependency in several Tika packages including at least: tika-parsers-standard-modules, tika-parsers-standard-package, tika-app, tika-grpc and tika-server-standard. Users are recommended to upgrade to version 3.2.2, which fixes this issue.
- Record
DEBIAN-CVE-2025-54988- CVSS 3.1
- 8.4 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Show 5 moreShow less
OSVGHSA-p72g-pv48-7w9x
Apache Tika XXE Vulnerability via Crafted XFA File Inside a PDF
Critical XXE in Apache Tika (tika-parser-pdf-module) in Apache Tika 1.13 through and including 3.2.1 on all platforms allows an attacker to carry out XML External Entity injection via a crafted XFA file inside of a PDF. An attacker may be able to read sensitive data or trigger malicious requests to internal resources or third-party servers. Note that the tika-parser-pdf-module is used as a dependency in several Tika packages including at least: tika-parsers-standard-modules, tika-parsers-standard-package, tika-app, tika-grpc and tika-server-standard.
Users are recommended to upgrade to version 3.2.2, which fixes this issue.
- Record
GHSA-p72g-pv48-7w9x- CVSS 4.0
- 9.3 Critical
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N - CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-611
- Updated
- 2026-11-02
OSVROOT-APP-MAVEN-CVE-2025-54988
CVE-2025-54988 in io.root.org.apache.tika:tika-parser-pdf-module - Patched by Root
Root has patched CVE-2025-54988 in the io.root.org.apache.tika:tika-parser-pdf-module package for Root:Maven. Multiple fixed versions available.
- Record
ROOT-APP-MAVEN-CVE-2025-54988- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2025-54988
Critical XXE in Apache Tika (tika-parser-pdf-module) in Apache Tika 1.13 through and including 3.2.1 on all platforms allows an attacker to carry out XML External Entity injection via a crafted XFA file inside of a PDF. An attacker may be able to read sensitive data or trigger malicious requests to internal resources or third-party servers. Note that the tika-parser-pdf-module is used as a dependency in several Tika packages including at least: tika-parsers-standard-modules, tika-parsers-standard-package, tika-app, tika-grpc and tika-server-standard. Users are recommended to upgrade to version 3.2.2, which fixes this issue.
- Record
UBUNTU-CVE-2025-54988- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 3.1
- 8.4 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-04
OSVCLSA-2026-1777596014 No score
TuxCare security update for org.apache.tika (2 CVEs)
TuxCare rebuilt 3 org.apache.tika packages to address 2 CVEs. Fixed in 2.9.4-tuxcare.1.
- Record
CLSA-2026-1777596014- Updated
- 2026-11-02
OSVUSN-8324-1 No score
tika vulnerabilities
It was discovered that Apache Tika incorrectly handled XML external entities when parsing XFA content in PDF files. An attacker could possibly use this issue to obtain sensitive information or send malicious requests to internal resources or third-party servers.
- Record
USN-8324-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.apache.tika:tika-parser-pdf-moduleMaven |
1.13 up to 3.2.2 | 3.2.2 |
org.apache.tika:tika-parsersMaven |
1.13 up to 2.0.0-ALPHA | 2.0.0-ALPHA |
org.apache.tika:tika-coreTuxCare:Maven From an advisory covering 2 CVEs |
2.9.4 up to 2.9.4-tuxcare.1 | 2.9.4-tuxcare.1 |
org.apache.tika:tika-parser-pdf-moduleTuxCare:Maven From an advisory covering 2 CVEs |
2.9.4 up to 2.9.4-tuxcare.1 | 2.9.4-tuxcare.1 |
org.apache.tika:tika-parsersTuxCare:Maven From an advisory covering 2 CVEs |
2.9.4 up to 2.9.4-tuxcare.1 | 2.9.4-tuxcare.1 |
tikaDebian:11 |
before 1.22-2+deb11u1, plus listed versions 1.22-2 |
1.22-2+deb11u1 |
tikaDebian:11 From an advisory covering 2 CVEs |
before 1.22-2+deb11u1, plus listed versions 1.22-2 |
1.22-2+deb11u1 |
org.apache.tika:tika-parser-pdf-moduleMaven |
1.13 up to 3.2.2, plus listed versions 2.0.02.0.0-ALPHA2.0.0-BETA2.1.02.2.0 Show 19 moreShow less2.2.12.3.02.4.02.4.12.5.02.6.02.7.02.8.02.9.02.9.12.9.22.9.32.9.43.0.03.0.0-BETA3.0.0-BETA23.1.03.2.03.2.1 |
3.2.2 |
org.apache.tika:tika-parsersMaven |
1.13 up to 2.0.0-ALPHA, plus listed versions 1.141.151.161.171.18 Show 17 moreShow less1.191.19.11.201.211.221.231.241.24.11.251.261.271.281.28.11.28.21.28.31.28.41.28.5 |
2.0.0-ALPHA |
io.root.org.apache.tika:tika-parser-pdf-moduleRoot:Maven |
before 2.9.2-root.io.3 | 2.9.2-root.io.32.9.2-root.io.52.9.2-root.io.62.9.2-root.io.42.9.3-root.io.12.9.3-root.io.2 |
Show 8 moreShow less
| Package | Affected | Fixed |
|---|---|---|
tikaUbuntu:Pro:20.04:LTS |
before 1.22-1ubuntu0.1~esm2, plus listed versions 1.22-11.22-1ubuntu0.1~esm1 |
1.22-1ubuntu0.1~esm2 |
tikaUbuntu:22.04:LTS |
before 1.22-2+deb11u1build0.22.04.1, plus listed versions 1.22-2 |
1.22-2+deb11u1build0.22.04.1 |
tikaUbuntu:24.04:LTS |
All versions, plus listed versions 1.22-2 |
None known |
tikaUbuntu:25.10 |
All versions, plus listed versions 1.22-2 |
None known |
tikaUbuntu:26.10 |
All versions, plus listed versions 1.22-2 |
None known |
tikaUbuntu:26.04:LTS |
All versions, plus listed versions 1.22-2 |
None known |
tikaUbuntu:Pro:20.04:LTS From an advisory covering 2 CVEs |
before 1.22-1ubuntu0.1~esm2, plus listed versions 1.22-11.22-1ubuntu0.1~esm1 |
1.22-1ubuntu0.1~esm2 |
tikaUbuntu:22.04:LTS From an advisory covering 2 CVEs |
before 1.22-2+deb11u1build0.22.04.1, plus listed versions 1.22-2 |
1.22-2+deb11u1build0.22.04.1 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| PoC in GitHub | mgthuramoemyint/POC-CVE-2025-54988 | 2025-09-04 |
| PoC in GitHub | galoryber/cve-2025-54988-VulnTikaProject | 2025-12-17 |
| Metasploit | Elasticsearch ingest-attachment Apache Tika XFA XXE Local File Read | 2025-08-20 |
| Nuclei | Apache Tika - XXE Injection |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | ||
| affected, exploits, facts | OSV | |
| first indexed | CVE List, EUVD, GitHub Advisories, Metasploit, Nuclei, NVD, OSV, PoC in GitHub |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2025-54988 is a high vulnerability (CVSS 8.4) in Apache Tika, published August 20, 2025. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 47.9%, the 98th percentile. Fixed in org.apache.tika:tika-parser-pdf-module 3.2.2.
References
lists.apache.org/thread/8xn3rqy6kz5b3l1t83kcofkw0w4mmj1w
lists.debian.org/debian-lts-announce/2025/10/msg00030.html
openwall.com/lists/oss-security/2025/08/20/2
nvd.nist.gov/vuln/detail/CVE-2025-54988
github.com/apache/tika/pull/2291
Show 14 moreShow less
archive.apache.org/dist/tika/3.2.2/CHANGES-3.2.2.txt
issues.apache.org/jira/browse/TIKA-4459
repo.maven.apache.org/maven2
security-tracker.debian.org/tracker/CVE-2025-54988
ubuntu.com/security/CVE-2025-54988
cve.org/CVERecord?id=CVE-2025-54988