CVE-2025-54988Disclosure(apache / tika)

LOWCVSS 8.4 · HIGH

Exploit discussion active in current signal (1 latest mentions)

Immediate actions

Prioritize remediation for apache tika systems immediately
Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft
Track advisory updates for patch or workaround availability

Recommended action window: High priority (within 72h)

NVD description

Critical XXE in Apache Tika (tika-parser-pdf-module) in Apache Tika 1.13 through and including 3.2.1 on all platforms allows an attacker to carry out XML External Entity injection via a crafted XFA file inside of a PDF. An attacker may be able to read sensitive data or trigger malicious requests to internal resources or third-party servers. Note that the tika-parser-pdf-module is used as a dependency in several Tika packages including at least: tika-parsers-standard-modules, tika-parsers-standard-package, tika-app, tika-grpc and tika-server-standard. Users are recommended to upgrade to version 3.2.2, which fixes this issue.

apache CVEs Back to dashboard

3.5/ 10 priority

Sources & remediation

Vendor / third-party advisories

https://lists.apache.org/thread/8xn3rqy6kz5b3l1t83kcofkw0w4mmj1w

Other references

Weakness type (CWE)

CWE-611

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

NONE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

tika

Threat summary

Public PoC and exploit tooling are both present
2 mentions across 2 observed days
Momentum state: stable

What's happening

Exploit tool or code specified in 1 signal
PoC mentioned or linked in 2 signals
Technical details provided in 2 signals
Disclosure: 1 classified signal
Peaked 1d ago at 1 mentions (2026-07-30); latest day: 1
2 total mentions across 2 days

Affected systems

Vendors

apache

Products

tika

Deep dive

Activity timeline2 mentions / 2d

Signal classification2 categories

Disclosure

150.0%

Exploit

150.0%

Referenced assets3 URLs

By indicator

Classification over time

Date	Total	Labels

2026-07-30	1	Disclosure1
2026-07-31	1	Exploit1

Full discourse2 posts

kmkz@kmkz_security90d
Exploit
Back from mission, I released the exploit I used (it was really helpful) for #Apache Tika XFA XXE exposed through #Elasticsearch’s attachment ingest processor, leading to arbitrary file read: CVE-2025-54988 / CVE-2025-66516 - Python PoC - version-aware Metasploit module (loot storage, automatic cleanup + no index or document creation) https://github.com/kmkz/Exploits/tree/master/2026/CVE-2025-54988-Elasticsearch-Tika-XFA-XXE @metasploit PR done: https://github.com/rapid7/metasploit-framework/pull/21739
Post summary
The author released a Python PoC and a Metasploit module to exploit the Apache Tika XFA XXE vulnerability in Elasticsearch’s attachment ingest processor (CVE‑2025‑54988/CVE‑2025‑66516), providing active exploit code rather than just a disclosure.
0402052.6K
19.8K followersView on X
pdnuclei-bot@pdnuclei_bot91d
Disclosure
🚨 CVE-2025-54988 - critical 🚨 Apache Tika - XXE Injection > Apache Tika versions 1.13 through 3.2.1 are vulnerable to XXE via malicious XFA in PD... 👾 https://cloud.projectdiscovery.io/library/CVE-2025-54988 @pdnuclei #NucleiTemplates #cve
Post summary
The post announces Apache Tika CVE-2025-54988 as a critical XXE flaw with affected versions, provides a link likely to a detection template, but offers no proof of exploitation or patch details.
01021367
1.3K followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	apache	tika	-	-	-

Explore more

Back to dashboard apache CVEs tika vulnerabilities