Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.3
CVE-2025-54988: Apache Tika PDF parser may expose internal data
CVE-2025-54988 · published 1 year ago
Summary
The PDF parsing component of Apache Tika (versions 1.13 to 3.2.1) can be tricked by a specially crafted PDF to read files or contact internal network resources. This could let an attacker see confidential information or cause unwanted network traffic. Upgrade the Tika libraries to version 3.2.2 or later to stop the issue.
What to do
- Update apache org.apache.tika:tika-parser-pdf-module to version 3.2.2.
- Update apache org.apache.tika:tika-parsers to version 2.0.0-ALPHA.
- Update root io.root.org.apache.tika:tika-parser-pdf-module to version 2.9.2-root.io.4.
- Update canonical tika to version 1.22-1ubuntu0.1~esm2.
- Update root io.root.org.apache.tika:tika-parser-pdf-module to version 2.9.3-root.io.2.
- Update canonical tika to version 1.22-2+deb11u1build0.22.04.1.
- Update apache tika to version 3.2.2 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| maven | apache | org.apache.tika:tika-parser-pdf-module |
>= 1.13, < 3.2.2 Fix: upgrade to 3.2.2
|
| maven | apache | org.apache.tika:tika-parsers |
>= 1.13, < 2.0.0-ALPHA Fix: upgrade to 2.0.0-ALPHA
|
| – | apache | tika |
>= 1.13, < 3.2.2 cpe:2.3:a:apache:tika:*:*:*:*:*:*:*:* |
| Root:Maven | root | io.root.org.apache.tika:tika-parser-pdf-module |
< 2.9.2-root.io.4 < 2.9.3-root.io.2 Fix: upgrade to 2.9.2-root.io.4
|
| Ubuntu:18.04:LTS | canonical | tika | All versions |
| Ubuntu:Pro:20.04:LTS | canonical | tika |
< 1.22-1ubuntu0.1~esm2 Fix: upgrade to 1.22-1ubuntu0.1~esm2
|
| Ubuntu:24.04:LTS | canonical | tika | All versions |
| Ubuntu:22.04:LTS | canonical | tika |
< 1.22-2+deb11u1build0.22.04.1 Fix: upgrade to 1.22-2+deb11u1build0.22.04.1
|
| Ubuntu:25.10 | canonical | tika | All versions |
| Ubuntu:26.04:LTS | canonical | tika | All versions |
Original advisory text
Apache Tika PDF parser module: XXE vulnerability in PDFParser's handling of XFA
Critical XXE in Apache Tika (tika-parser-pdf-module) in Apache Tika 1.13 through and including 3.2.1 on all platforms allows an attacker to carry out XML External Entity injection via a crafted XFA file inside of a PDF. An attacker may be able to read sensitive data or trigger malicious requests to internal resources or third-party servers. Note that the tika-parser-pdf-module is used as a dependency in several Tika packages including at least: tika-parsers-standard-modules, tika-parsers-standard-package, tika-app, tika-grpc and tika-server-standard. Users are recommended to upgrade to version 3.2.2, which fixes this issue.
References
- https://github.com/apache/tika/pull/2291
- https://github.com/apache/tika/commit/2b52257304f4d3cde2b8463657380bdb936d9ef2
- https://archive.apache.org/dist/tika/3.2.2/CHANGES-3.2.2.txt
- https://issues.apache.org/jira/browse/TIKA-4459
- https://lists.apache.org/thread/stn9oh7rfn9yv76n1srxr9w56oy04p72
- https://github.com/advisories/GHSA-p72g-pv48-7w9x
- http://www.openwall.com/lists/oss-security/2025/08/20/2 URL
- http://www.openwall.com/lists/oss-security/2025/08/20/3 URL
- https://lists.debian.org/debian-lts-announce/2025/10/msg00030.html URL
- https://repo.maven.apache.org/maven2 URL
- https://lists.apache.org/thread/8xn3rqy6kz5b3l1t83kcofkw0w4mmj1w Third Party Advisory
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/54xxx/CVE-2025-54988... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2025-54988 Vendor Advisory
- https://ubuntu.com/security/notices/USN-8324-1 Vendor Advisory
- https://ubuntu.com/security/CVE-2025-54988 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2025-54988 Third Party Advisory
- https://www.openwall.com/lists/oss-security/2025/08/20/3 Third Party Advisory
- https://github.com/apache/tika/commit/bfee6d5569fe9197c4ea947a96e212825184ca33 Third Party Advisory
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker full control
Type
CWE-611XML External Entity (XXE)
Timeline
Published20 Aug 2025
Updated21 Oct 2026
First seen6 Mar 2026
Sources
UBUNTU-CVE-2025-54988 · OSV
GHSA-p72g-pv48-7w9x · GHSA
CVE-2025-54988 · NVD
CVE-2025-54988 · OSV
Track software like this
Free during beta