Apache Tika 1.13-3.2.1 - XML External Entity Injection via Crafted XFA in PDF
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2025-54988. PoCs published by mgthuramoemyint, galoryber.
AI-analyzed exploit summary This repository contains a Python script to generate PDFs with XFA forms exploiting an XXE vulnerability (CVE-2025-54988). It supports local file reads and out-of-band data exfiltration via external DTDs.
Description
Critical XXE in Apache Tika (tika-parser-pdf-module) in Apache Tika 1.13 through and including 3.2.1 on all platforms allows an attacker to carry out XML External Entity injection via a crafted XFA file inside of a PDF. An attacker may be able to read sensitive data or trigger malicious requests to internal resources or third-party servers. Note that the tika-parser-pdf-module is used as a dependency in several Tika packages including at least: tika-parsers-standard-modules, tika-parsers-standard-package, tika-app, tika-grpc and tika-server-standard. Users are recommended to upgrade to version 3.2.2, which fixes this issue.
Exploits (2)
This repository contains a Python script to generate PDFs with XFA forms exploiting an XXE vulnerability (CVE-2025-54988). It supports local file reads and out-of-band data exfiltration via external DTDs.
This repository provides a Spring Boot application demonstrating CVE-2025-54988, an XXE vulnerability in Apache Tika 3.2.1. It includes endpoints to trigger the vulnerability via file uploads, specifically targeting PDF parsing methods.
References (4)
Scores
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H