A critical XML External Entity (XXE) vulnerability exists in the tika-parser-pdf-module of Apache Tika versions 1.13 through 3.2.1. This flaw allows attackers to inject malicious XML entities via crafted XFA files in PDFs, potentially leading to unauthorized access to sensitive data or triggering harmful requests. Users are advised to upgrade to version 3.2.2 to mitigate this issue.
Details
| Severity | Base Score | CVE |
|---|---|---|
| CRITICAL | 9.8 | CVE-2025-54988 |
Exploitation
To exploit this vulnerability, an attacker can craft a malicious PDF file containing an XFA form that triggers XML External Entity injection when processed by the vulnerable tika-parser-pdf-module. This can lead to unauthorized access to sensitive information or the ability to make malicious requests to internal or external systems.
Affected Products
- tika-parsers-standard-modules: A standard module package for Tika that includes the vulnerable parser.
- tika-parsers-standard-package: A comprehensive package that incorporates various Tika parsers, including the affected module.
- tika-app: The command-line application for Tika that utilizes the vulnerable parser.
- tika-grpc: A gRPC service implementation of Tika that is affected by this vulnerability.
- tika-server-standard: The standard server implementation of Tika that relies on the vulnerable module.
Mitigation
To mitigate this vulnerability, users should upgrade to Apache Tika version 3.2.2 or later, which addresses the XXE issue. Additionally, it is recommended to implement security best practices such as validating and sanitizing input data and restricting access to sensitive resources.