CVE-2025-54988: Apache Tika XXE Vulnerability via Crafted XFA File Inside a PDF
(updated )
Critical XXE in Apache Tika (tika-parser-pdf-module) in Apache Tika 1.13 through and including 3.2.1 on all platforms allows an attacker to carry out XML External Entity injection via a crafted XFA file inside of a PDF. An attacker may be able to read sensitive data or trigger malicious requests to internal resources or third-party servers. Note that the tika-parser-pdf-module is used as a dependency in several Tika packages including at least: tika-parsers-standard-modules, tika-parsers-standard-package, tika-app, tika-grpc and tika-server-standard.
Users are recommended to upgrade to version 3.2.2, which fixes this issue.
References
- archive.apache.org/dist/tika/3.2.2/CHANGES-3.2.2.txt
- github.com/advisories/GHSA-p72g-pv48-7w9x
- github.com/apache/tika
- github.com/apache/tika/commit/2b52257304f4d3cde2b8463657380bdb936d9ef2
- github.com/apache/tika/pull/2291
- issues.apache.org/jira/browse/TIKA-4459
- lists.apache.org/thread/8xn3rqy6kz5b3l1t83kcofkw0w4mmj1w
- lists.apache.org/thread/stn9oh7rfn9yv76n1srxr9w56oy04p72
- lists.debian.org/debian-lts-announce/2025/10/msg00030.html
- nvd.nist.gov/vuln/detail/CVE-2025-54988
Code Behaviors & Features
Detect and mitigate CVE-2025-54988 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →