Apache Tika PDF parser module: XXE vulnerability in PDFParser's handling of XFA
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Debian DEBIAN-CVE-2025-54988 tika Fixed in: 1.22-2+deb11u1
- Ubuntu UBUNTU-CVE-2025-54988 tika
Original description The description as published by the source.
Critical XXE in Apache Tika (tika-parser-pdf-module) in Apache Tika 1.13 through and including 3.2.1 on all platforms allows an attacker to carry out XML External Entity injection via a crafted XFA file inside of a PDF. An attacker may be able to read sensitive data or trigger malicious requests to internal resources or third-party servers. Note that the tika-parser-pdf-module is used as a dependency in several Tika packages including at least: tika-parsers-standard-modules, tika-parsers-standard-package, tika-app, tika-grpc and tika-server-standard.
Users are recommended to upgrade to version 3.2.2, which fixes this issue.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
References
- advisory github.com
- advisory lists.apache.org
- advisory nvd.nist.gov
- web openwall.com
- web openwall.com
- web lists.debian.org
- web repo.maven.apache.org