Apache Tika - XXE Injection
CVE-2025-54988
Verified
Description
Apache Tika versions 1.13 through 3.2.1 are vulnerable to XXE via malicious XFA in PDFs, allowing file read and SSRF attacks.
Severity
Critical
CVSS Score
9.8
Exploit Probability
48%
Affected Product
tika
Published Date
April 27, 2026
Template Author
tx1ee, s4e-io
CVE-2025-54988.yaml
9.8Score
CVSS Metrics
CVSS Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE ID:
cwe-611
Remediation Steps
Upgrade to Apache Tika 3.2.2 or later.