CVE-2025-54988
NoneCVSS
—
EPSS
47.9%
Published
Aug 20, 2025
CISA due date
—
The record
Critical XXE in Apache Tika (tika-parser-pdf-module) in Apache Tika 1.13 through and including 3.2.1 on all platforms allows an attacker to carry out XML External Entity injection via a crafted XFA file inside of a PDF. An attacker may be able to read sensitive data or trigger malicious requests to internal resources or third-party servers. Note that the tika-parser-pdf-module is used as a dependency in several Tika packages including at least: tika-parsers-standard-modules, tika-parsers-standard-package, tika-app, tika-grpc and tika-server-standard. Users are recommended to upgrade to version 3.2.2, which fixes this issue.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Maven | org.apache.tika:tika-parser-pdf-module | 1.13 | 3.2.2 |
| Maven | org.apache.tika:tika-parsers | 1.13 | 2.0.0-ALPHA |
| Chainguard | apache-tika-2.9-compat | 0 | 2.9.4-r5 |
| Chainguard | apache-tika-3.0-compat | 0 | 3.0.0-r18 |
| Chainguard | apache-tika-3.1 | 0 | 3.1.0-r27 |
| Chainguard | apache-tika-3.1-compat | 0 | 3.1.0-r9 |
| Chainguard | apache-tika-fips-2.9-compat | 0 | 2.9.4-r1 |
| Chainguard | apache-tika-fips-3.0-compat | 0 | 3.0.0-r0 |
| Chainguard | apache-tika-fips-3.1-compat | 0 | 3.1.0-r1 |
| Chainguard | elasticsearch-8 | 0 | 8.19.2-r1 |
| Chainguard | elasticsearch-8-bitnami | 0 | 8.19.2-r1 |
| Chainguard | elasticsearch-8-config | 0 | 8.19.2-r1 |
| Chainguard | elasticsearch-8-iamguarded | 0 | 8.19.2-r1 |
| Chainguard | elasticsearch-8.17 | 0 | 8.17.10-r1 |
| Chainguard | elasticsearch-8.17-bitnami | 0 | 8.17.10-r1 |
| Chainguard | elasticsearch-8.17-config | 0 | 8.17.10-r1 |
| Chainguard | elasticsearch-9 | 0 | 0 |
| Chainguard | elasticsearch-9 | 0 | 9.1.2-r1 |
| Chainguard | elasticsearch-9-bitnami | 0 | 9.1.2-r1 |
| Chainguard | elasticsearch-9-bitnami | 0 | 0 |
| Chainguard | elasticsearch-9-config | 0 | 9.1.2-r1 |
| Chainguard | elasticsearch-9-config | 0 | 0 |
| Chainguard | elasticsearch-9-iamguarded | 0 | 9.1.2-r1 |
| Chainguard | elasticsearch-9-iamguarded | 0 | 0 |
| Chainguard | elasticsearch-config | 0 | 8.19.2-r1 |
| Chainguard | elasticsearch-fips-8 | 0 | 8.19.2-r3 |
| Chainguard | elasticsearch-fips-8-bitnami | 0 | 8.19.2-r3 |
| Chainguard | elasticsearch-fips-8-config | 0 | 8.19.2-r3 |
| Chainguard | elasticsearch-fips-8-policy-140-2 | 0 | 8.19.2-r3 |
| Chainguard | elasticsearch-fips-8-policy-140-3 | 0 | 8.19.2-r3 |
| Chainguard | elasticsearch-fips-9 | 0 | 0 |
| Chainguard | elasticsearch-fips-9-bitnami | 0 | 0 |
| Chainguard | elasticsearch-fips-9-config | 0 | 0 |
| Chainguard | elasticsearch-fips-9.0 | 0 | 9.0.8-r0 |
| Chainguard | elasticsearch-fips-9.0-bitnami | 0 | 9.0.8-r0 |
| Chainguard | elasticsearch-fips-9.0-config | 0 | 9.0.8-r0 |
| Chainguard | elasticsearch-fips-9.1 | 0 | 9.1.2-r12 |
| Chainguard | elasticsearch-fips-9.1-bitnami | 0 | 9.1.2-r12 |
| Chainguard | elasticsearch-fips-9.1-config | 0 | 9.1.2-r12 |
| Chainguard | opensearch-2 | 0 | 2.19.4-r0 |
| Chainguard | opensearch-2-alerting | 0 | 2.19.4-r0 |
| Chainguard | opensearch-2-analysis-icu | 0 | 2.19.4-r0 |
| Chainguard | opensearch-2-analysis-kuromoji | 0 | 2.19.4-r0 |
| Chainguard | opensearch-2-analysis-nori | 0 | 2.19.4-r0 |
| Chainguard | opensearch-2-analysis-phonetic | 0 | 2.19.4-r0 |
| Chainguard | opensearch-2-analysis-smartcn | 0 | 2.19.4-r0 |
| Chainguard | opensearch-2-analysis-stempel | 0 | 2.19.4-r0 |
| Chainguard | opensearch-2-analysis-ukrainian | 0 | 2.19.4-r0 |
| Chainguard | opensearch-2-anomaly-detection | 0 | 2.19.4-r0 |
| Chainguard | opensearch-2-asynchronous-search | 0 | 2.19.4-r0 |
| Chainguard | opensearch-2-cross-cluster-replication | 0 | 2.19.4-r0 |
| Chainguard | opensearch-2-crypto-kms | 0 | 2.19.4-r0 |
| Chainguard | opensearch-2-custom-codecs | 0 | 2.19.4-r0 |
| Chainguard | opensearch-2-discovery-azure-classic | 0 | 2.19.4-r0 |
| Chainguard | opensearch-2-discovery-ec2 | 0 | 2.19.4-r0 |
| Chainguard | opensearch-2-discovery-gce | 0 | 2.19.4-r0 |
| Chainguard | opensearch-2-entrypoint-compat | 0 | 2.19.4-r0 |
| Chainguard | opensearch-2-geospatial | 0 | 2.19.4-r0 |
| Chainguard | opensearch-2-identity-shiro | 0 | 2.19.4-r0 |
| Chainguard | opensearch-2-index-management | 0 | 2.19.4-r0 |
| Chainguard | opensearch-2-ingest-attachment | 0 | 2.19.4-r0 |
| Chainguard | opensearch-2-job-scheduler | 0 | 2.19.4-r0 |
| Chainguard | opensearch-2-k-nn | 0 | 2.19.4-r0 |
| Chainguard | opensearch-2-mapper-annotated-text | 0 | 2.19.4-r0 |
| Chainguard | opensearch-2-mapper-murmur3 | 0 | 2.19.4-r0 |
| Chainguard | opensearch-2-mapper-size | 0 | 2.19.4-r0 |
| Chainguard | opensearch-2-ml-commons | 0 | 2.19.4-r0 |
| Chainguard | opensearch-2-neural-search | 0 | 2.19.4-r0 |
| Chainguard | opensearch-2-notifications | 0 | 2.19.4-r0 |
| Chainguard | opensearch-2-observability | 0 | 2.19.4-r0 |
| Chainguard | opensearch-2-performance-analyzer | 0 | 2.19.4-r0 |
| Chainguard | opensearch-2-reporting | 0 | 2.19.4-r0 |
| Chainguard | opensearch-2-repository-azure | 0 | 2.19.4-r0 |
| Chainguard | opensearch-2-repository-gcs | 0 | 2.19.4-r0 |
| Chainguard | opensearch-2-repository-s3 | 0 | 2.19.4-r0 |
| Chainguard | opensearch-2-security | 0 | 2.19.4-r0 |
| Chainguard | opensearch-2-security-analytics | 0 | 2.19.4-r0 |
| Chainguard | opensearch-2-sql | 0 | 2.19.4-r0 |
| Chainguard | opensearch-2-store-smb | 0 | 2.19.4-r0 |
| Chainguard | opensearch-2-telemetry-otel | 0 | 2.19.4-r0 |
| Chainguard | opensearch-2-transport-nio | 0 | 2.19.4-r0 |
| Chainguard | opensearch-3 | 0 | 3.3.2-r0 |
| Chainguard | opensearch-3-alerting | 0 | 3.3.2-r0 |
| Chainguard | opensearch-3-analysis-icu | 0 | 3.3.2-r0 |
| Chainguard | opensearch-3-analysis-kuromoji | 0 | 3.3.2-r0 |
| Chainguard | opensearch-3-analysis-nori | 0 | 3.3.2-r0 |
| Chainguard | opensearch-3-analysis-phonetic | 0 | 3.3.2-r0 |
| Chainguard | opensearch-3-analysis-smartcn | 0 | 3.3.2-r0 |
| Chainguard | opensearch-3-analysis-stempel | 0 | 3.3.2-r0 |
| Chainguard | opensearch-3-analysis-ukrainian | 0 | 3.3.2-r0 |
| Chainguard | opensearch-3-anomaly-detection | 0 | 3.3.2-r0 |
| Chainguard | opensearch-3-asynchronous-search | 0 | 3.3.2-r0 |
| Chainguard | opensearch-3-cross-cluster-replication | 0 | 3.3.2-r0 |
| Chainguard | opensearch-3-crypto-kms | 0 | 3.3.2-r0 |
| Chainguard | opensearch-3-custom-codecs | 0 | 3.3.2-r0 |
| Chainguard | opensearch-3-discovery-azure-classic | 0 | 3.3.2-r0 |
| Chainguard | opensearch-3-discovery-ec2 | 0 | 3.3.2-r0 |
| Chainguard | opensearch-3-discovery-gce | 0 | 3.3.2-r0 |
| Chainguard | opensearch-3-geospatial | 0 | 3.3.2-r0 |
| Chainguard | opensearch-3-identity-shiro | 0 | 3.3.2-r0 |
| Chainguard | opensearch-3-index-management | 0 | 3.3.2-r0 |
| Chainguard | opensearch-3-ingest-attachment | 0 | 3.3.2-r0 |
| Chainguard | opensearch-3-job-scheduler | 0 | 3.3.2-r0 |
| Chainguard | opensearch-3-k-nn | 0 | 3.3.2-r0 |
| Chainguard | opensearch-3-mapper-annotated-text | 0 | 3.3.2-r0 |
| Chainguard | opensearch-3-mapper-murmur3 | 0 | 3.3.2-r0 |
| Chainguard | opensearch-3-mapper-size | 0 | 3.3.2-r0 |
| Chainguard | opensearch-3-ml-commons | 0 | 3.3.2-r0 |
| Chainguard | opensearch-3-neural-search | 0 | 3.3.2-r0 |
| Chainguard | opensearch-3-notifications | 0 | 3.3.2-r0 |
| Chainguard | opensearch-3-observability | 0 | 3.3.2-r0 |
| Chainguard | opensearch-3-performance-analyzer | 0 | 3.3.2-r0 |
| Chainguard | opensearch-3-reporting | 0 | 3.3.2-r0 |
| Chainguard | opensearch-3-repository-azure | 0 | 3.3.2-r0 |
| Chainguard | opensearch-3-repository-gcs | 0 | 3.3.2-r0 |
| Chainguard | opensearch-3-repository-s3 | 0 | 3.3.2-r0 |
| Chainguard | opensearch-3-security | 0 | 3.3.2-r0 |
| Chainguard | opensearch-3-security-analytics | 0 | 3.3.2-r0 |
| Chainguard | opensearch-3-sql | 0 | 3.3.2-r0 |
| Chainguard | opensearch-3-store-smb | 0 | 3.3.2-r0 |
| Chainguard | opensearch-3-telemetry-otel | 0 | 3.3.2-r0 |
| Debian:11 | tika | 0 | No fix |
| Wolfi | apache-tika-3.0-compat | 0 | 3.0.0-r18 |
| Wolfi | apache-tika-3.1 | 0 | 3.1.0-r27 |
| Wolfi | apache-tika-3.1-compat | 0 | 3.1.0-r9 |
| Wolfi | opensearch-2 | 0 | 2.19.4-r0 |
| Wolfi | opensearch-2-alerting | 0 | 2.19.4-r0 |
| Wolfi | opensearch-2-analysis-icu | 0 | 2.19.4-r0 |
| Wolfi | opensearch-2-analysis-kuromoji | 0 | 2.19.4-r0 |
| Wolfi | opensearch-2-analysis-nori | 0 | 2.19.4-r0 |
| Wolfi | opensearch-2-analysis-phonetic | 0 | 2.19.4-r0 |
| Wolfi | opensearch-2-analysis-smartcn | 0 | 2.19.4-r0 |
| Wolfi | opensearch-2-analysis-stempel | 0 | 2.19.4-r0 |
| Wolfi | opensearch-2-analysis-ukrainian | 0 | 2.19.4-r0 |
| Wolfi | opensearch-2-anomaly-detection | 0 | 2.19.4-r0 |
| Wolfi | opensearch-2-asynchronous-search | 0 | 2.19.4-r0 |
| Wolfi | opensearch-2-cross-cluster-replication | 0 | 2.19.4-r0 |
| Wolfi | opensearch-2-crypto-kms | 0 | 2.19.4-r0 |
| Wolfi | opensearch-2-custom-codecs | 0 | 2.19.4-r0 |
| Wolfi | opensearch-2-discovery-azure-classic | 0 | 2.19.4-r0 |
| Wolfi | opensearch-2-discovery-ec2 | 0 | 2.19.4-r0 |
| Wolfi | opensearch-2-discovery-gce | 0 | 2.19.4-r0 |
| Wolfi | opensearch-2-geospatial | 0 | 2.19.4-r0 |
| Wolfi | opensearch-2-identity-shiro | 0 | 2.19.4-r0 |
| Wolfi | opensearch-2-index-management | 0 | 2.19.4-r0 |
| Wolfi | opensearch-2-ingest-attachment | 0 | 2.19.4-r0 |
| Wolfi | opensearch-2-job-scheduler | 0 | 2.19.4-r0 |
| Wolfi | opensearch-2-k-nn | 0 | 2.19.4-r0 |
| Wolfi | opensearch-2-mapper-annotated-text | 0 | 2.19.4-r0 |
| Wolfi | opensearch-2-mapper-murmur3 | 0 | 2.19.4-r0 |
| Wolfi | opensearch-2-mapper-size | 0 | 2.19.4-r0 |
| Wolfi | opensearch-2-ml-commons | 0 | 2.19.4-r0 |
| Wolfi | opensearch-2-neural-search | 0 | 2.19.4-r0 |
| Wolfi | opensearch-2-notifications | 0 | 2.19.4-r0 |
| Wolfi | opensearch-2-observability | 0 | 2.19.4-r0 |
| Wolfi | opensearch-2-performance-analyzer | 0 | 2.19.4-r0 |
| Wolfi | opensearch-2-reporting | 0 | 2.19.4-r0 |
| Wolfi | opensearch-2-repository-azure | 0 | 2.19.4-r0 |
| Wolfi | opensearch-2-repository-gcs | 0 | 2.19.4-r0 |
| Wolfi | opensearch-2-repository-s3 | 0 | 2.19.4-r0 |
| Wolfi | opensearch-2-security | 0 | 2.19.4-r0 |
| Wolfi | opensearch-2-security-analytics | 0 | 2.19.4-r0 |
| Wolfi | opensearch-2-sql | 0 | 2.19.4-r0 |
| Wolfi | opensearch-2-store-smb | 0 | 2.19.4-r0 |
| Wolfi | opensearch-2-telemetry-otel | 0 | 2.19.4-r0 |
| Wolfi | opensearch-2-transport-nio | 0 | 2.19.4-r0 |
| Wolfi | opensearch-3 | 0 | 3.3.2-r0 |
| Wolfi | opensearch-3-alerting | 0 | 3.3.2-r0 |
| Wolfi | opensearch-3-analysis-icu | 0 | 3.3.2-r0 |
| Wolfi | opensearch-3-analysis-kuromoji | 0 | 3.3.2-r0 |
| Wolfi | opensearch-3-analysis-nori | 0 | 3.3.2-r0 |
| Wolfi | opensearch-3-analysis-phonetic | 0 | 3.3.2-r0 |
| Wolfi | opensearch-3-analysis-smartcn | 0 | 3.3.2-r0 |
| Wolfi | opensearch-3-analysis-stempel | 0 | 3.3.2-r0 |
| Wolfi | opensearch-3-analysis-ukrainian | 0 | 3.3.2-r0 |
| Wolfi | opensearch-3-anomaly-detection | 0 | 3.3.2-r0 |
| Wolfi | opensearch-3-asynchronous-search | 0 | 3.3.2-r0 |
| Wolfi | opensearch-3-cross-cluster-replication | 0 | 3.3.2-r0 |
| Wolfi | opensearch-3-crypto-kms | 0 | 3.3.2-r0 |
| Wolfi | opensearch-3-custom-codecs | 0 | 3.3.2-r0 |
| Wolfi | opensearch-3-discovery-azure-classic | 0 | 3.3.2-r0 |
| Wolfi | opensearch-3-discovery-ec2 | 0 | 3.3.2-r0 |
| Wolfi | opensearch-3-discovery-gce | 0 | 3.3.2-r0 |
| Wolfi | opensearch-3-geospatial | 0 | 3.3.2-r0 |
| Wolfi | opensearch-3-identity-shiro | 0 | 3.3.2-r0 |
| Wolfi | opensearch-3-index-management | 0 | 3.3.2-r0 |
| Wolfi | opensearch-3-ingest-attachment | 0 | 3.3.2-r0 |
| Wolfi | opensearch-3-job-scheduler | 0 | 3.3.2-r0 |
| Wolfi | opensearch-3-k-nn | 0 | 3.3.2-r0 |
| Wolfi | opensearch-3-mapper-annotated-text | 0 | 3.3.2-r0 |
| Wolfi | opensearch-3-mapper-murmur3 | 0 | 3.3.2-r0 |
| Wolfi | opensearch-3-mapper-size | 0 | 3.3.2-r0 |
| Wolfi | opensearch-3-ml-commons | 0 | 3.3.2-r0 |
| Wolfi | opensearch-3-neural-search | 0 | 3.3.2-r0 |
| Wolfi | opensearch-3-notifications | 0 | 3.3.2-r0 |
| Wolfi | opensearch-3-observability | 0 | 3.3.2-r0 |
| Wolfi | opensearch-3-performance-analyzer | 0 | 3.3.2-r0 |
| Wolfi | opensearch-3-reporting | 0 | 3.3.2-r0 |
| Wolfi | opensearch-3-repository-azure | 0 | 3.3.2-r0 |
| Wolfi | opensearch-3-repository-gcs | 0 | 3.3.2-r0 |
Related vulnerabilities
- CVE-2025-66516 Apache Tika has XXE vulnerability Also affects org.apache.tika:tika-parser-pdf-module
- CVE-2025-48924 Apache Commons Lang is vulnerable to Uncontrolled Recursion when processing long inputs Also affects apache-tika-2.9-compat
- CVE-2024-8184 Eclipse Jetty's ThreadLimitHandler.getRemote() vulnerable to remote DoS attacks Also affects apache-tika-2.9-compat
- CVE-2024-6763 Eclipse Jetty URI parsing of invalid authority Also affects apache-tika-2.9-compat
- CVE-2025-68161 Apache Log4j does not verify the TLS hostname in its Socket Appender Also affects apache-tika-3.0-compat
- CVE-2025-22227 In some specific scenarios with chained redirects, Reactor Netty HTTP client leaks… Also affects elasticsearch-8
- CVE-2025-25193 Denial of Service attack on windows app using Netty Also affects elasticsearch-8
- CVE-2024-12539 Elasticsearch Incorrect Authorization vulnerability Also affects elasticsearch-8