CVE catalog

CVE-2025-54988

tika - security update

[CVE catalog]

Severity
Critical · CVSS 9.4CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L
Published
Updated
Source
[NVD] · [CVE record]
EPSS
47.95% · Oct 25, 2026

Critical XXE in Apache Tika (tika-parser-pdf-module) in Apache Tika 1.13 through and including 3.2.1 on all platforms allows an attacker to carry out XML External Entity injection via a crafted XFA file inside of a PDF. An attacker may be able to read sensitive data or trigger malicious requests to internal resources or third-party servers. Note that the tika-parser-pdf-module is used as a dependency in several Tika packages including at least: tika-parsers-standard-modules, tika-parsers-standard-package, tika-app, tika-grpc and tika-server-standard. Users are recommended to upgrade to version 3.2.2, which fixes this issue.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debiantika111.22-2vulnerable
Debiantika111.22-2+deb11u1fixed
Ubuntutikapro1.22-1vulnerable
Ubuntutikapro1.22-1ubuntu0.1~esm1vulnerable
Ubuntutikapro1.22-1ubuntu0.1~esm2fixed
Ubuntutika22.041.22-2vulnerable
Ubuntutika22.041.22-2+deb11u1build0.22.04.1fixed
Debiantika111.22-2vulnerable
Debiantika111.22-2+deb11u1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debiantikadeb111.22-2+deb11u1Not reportedDEBIAN-CVE-2025-54988Not reported
Ubuntutikadebpro1.22-1ubuntu0.1~esm2Not reportedUSN-8324-1Not reported
Ubuntutikadeb22.041.22-2+deb11u1build0.22.04.1Not reportedUSN-8324-1Not reported
Debiantikadeb111.22-2+deb11u1Not reportedDLA-4350-1Not reported

OpenFactory catalog packages

No matching packages in this catalog.

Observed:

References

[FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX]