9.8

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-54988

CVE-2025-54988: Apache Tika XXE Vulnerability via Crafted XFA File Inside a PDF

Critical XXE in Apache Tika (tika-parser-pdf-module) in Apache Tika 1.13 through and including 3.2.1 on all platforms allows an attacker to carry out XML External Entity injection via a crafted XFA file inside of a PDF. An attacker may be able to read sensitive data or trigger malicious requests to internal resources or third-party servers. Note that the tika-parser-pdf-module is used as a dependency in several Tika packages including at least: tika-parsers-standard-modules, tika-parsers-standard-package, tika-app, tika-grpc and tika-server-standard.

Users are recommended to upgrade to version 3.2.2, which fixes this issue.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-54988

CVE-2025-54988:

9.8

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
org.apache.tika:tika-parser-pdf-module	maven	>= 1.13, < 3.2.2	3.2.2

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a classic XML External Entity (XXE) injection in the tika-parser-pdf-module. The root cause is the insecure configuration of XML parsers and transformers within Apache Tika. The investigation of the commits between the vulnerable version 3.2.1 and the patched version 3.2.2 revealed two key commits that address this issue.

The first commit, 94acef2854eed07f0ded357c13a659409495ca49, directly patches the getXMLInputFactory method in org.apache.tika.utils.XMLReaderUtils. It explicitly disables DTDs and the processing of external entities, which are the root cause of XXE vulnerabilities. This is the primary fix.

The second commit, bd9b05352ddccf0b89821c2d683e9b80b95fab35, is a hardening commit that replaces all local instantiations of SAXTransformerFactory with a centralized, secure factory method XMLReaderUtils.getSAXTransformerFactory(). This ensures that all XML transformations are performed using a securely configured transformer, preventing XXE across the application.

The vulnerable functions are those that were either directly patched to be secure or were modified to use the new secure factory methods. The core vulnerable function is org.apache.tika.utils.XMLReaderUtils.getXMLInputFactory, as its insecure configuration was the primary enabler of the XXE vulnerability. Other functions in the TikaCLI, TikaGUI, TikaGrpcServerImpl, and TikaResource classes were also vulnerable because they used insecurely configured XML transformers. The patches effectively remediate the vulnerability by enforcing secure XML processing defaults throughout the Tika library.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.