XML External Entity injection in Apache Tika - CVE-2025-66516,CVE-2025-54988

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU114385

XML External Entity injection in Apache Tika - CVE-2025-66516,CVE-2025-54988

Published: August 22, 2025 / Updated: January 22, 2026


Vulnerability identifier: #VU114385
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N]
CVE-ID: CVE-2025-66516,CVE-2025-54988
CWE-ID: CWE-611
Exploitation vector: Remote access
Exploit availability: Public exploit is available

Vulnerability details

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to insufficient validation of user-supplied XML input within the PDF parser module. A remote attacker can pass a specially crafted XML code to the affected application and view contents of arbitrary files on the system or initiate requests to external systems.

Successful exploitation of the vulnerability may allow an attacker to view contents of arbitrary file on the server or perform network scanning of internal and external infrastructure.


Affected software

Apache Tika
IBM Observability with Instana
IBM SPSS Analytic Server
Crucible Server
Crowd Data Center
Confluence Data Center
Bamboo Server
Jira Software Data Center
Jira Service Management Server
Jira Service Management Data Center
Oracle Middleware Common Libraries and Tools
IBM SPSS Modeler
Red Hat OpenShift Dev Spaces
Content Collector for Microsoft SharePoint
Content Collector for File Systems
Content Collector for Email
webMethods Integration Server
Astronomer with IBM
Operations Analytics - Log Analysis
OpenPages for IBM Cloud Pak for Data
OpenPages Cloud pak for data service version
IBM OpenPages with Watson
IBM i Access Client Solutions
Primavera Unifier
Atlassian Fisheye
PeopleSoft Enterprise PeopleTools
Communications Unified Assurance
Crowd Server
Oracle Communications Order and Service Management
Confluence Server
Enterprise Search
IBM InfoSphere Information Server
Elasticsearch
Oracle Business Process Management Suite
Cloudera Data Platform Private Cloud Base for IBM
Jira Software Server
FortiDLP Agent
Oracle Commerce Guided Search
Ubuntu
ColdFusion
tika (Ubuntu package)
Red Hat Camel for Spring Boot

How to mitigate CVE-2025-66516,CVE-2025-54988

Install updates from vendor's website.

Apache Tika - update to 3.2.2
webMethods Integration Server - update to IS 11.1 Core Fix9
Astronomer with IBM - update to 1.1.0
IBM Observability with Instana - update to 1.0.307
Operations Analytics - Log Analysis - update to 1.3.8.4
Atlassian Fisheye - update to 4.9.6
Crucible Server - update to 4.9.6
OpenPages for IBM Cloud Pak for Data - update to 5.2.2
Crowd Data Center - addressed in versions 6.3.4, 7.1.2
Crowd Server - addressed in versions 6.3.4, 7.1.2
Confluence Server - addressed in versions 8.5.31, 9.2.13, 10.2.2
Confluence Data Center - addressed in versions 8.5.31, 9.2.13, 10.2.2
Enterprise Search - addressed in versions 8.18.6, 8.19.3
Elasticsearch - addressed in versions 8.18.6, 8.19.3, 9.0.6, 9.1.3
OpenPages Cloud pak for data service version - update to 9.5.2
Bamboo Server - addressed in versions 9.6.20, 10.2.12, 12.0.2
Jira Software Server - addressed in versions 9.12.30, 10.3.13, 11.2.0
Jira Software Data Center - addressed in versions 9.12.30, 10.3.13, 11.2.0
Jira Service Management Server - addressed in versions 10.3.15, 11.2.1
Jira Service Management Data Center - addressed in versions 10.3.15, 11.2.1
FortiDLP Agent - update to 12.2.3
IBM InfoSphere Information Server - update to 11.7.1.6 Service pack 1
ColdFusion - addressed in versions 2023 Update 18, 2025 Update 6
tika (Ubuntu package) - addressed in versions 1.22-1ubuntu0.1~esm2, 1.22-2+deb11u1build0.22.04.1
Red Hat OpenShift Dev Spaces - update to 3.25.0
Content Collector for Microsoft SharePoint - update to 4.0.1.17 Fix Pack 17
Content Collector for File Systems - update to 4.0.1.17 Fix Pack 17
Content Collector for Email - update to 4.0.1.17 Fix Pack 17
Red Hat Camel for Spring Boot - update to 4.14.2
Cloudera Data Platform Private Cloud Base for IBM - addressed in versions 7.1.9 SP1 CHF 14, 7.3.1.700 SP3 CHF 2
IBM OpenPages with Watson - addressed in versions 8.3.0.3.3, 9.0.0.5.7, 9.1.2

Links to Public Exploits and PoC-codes

External References

Related Security Bulletins