DeutschShown in its original language — a full translation is planned for a future version.
Apache Tika: Schwachstelle ermöglicht Infogewinn oder Manipulation
view advisory published 2025-08-20
Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Apache Tika ausnutzen, um sensible Daten auszulesen oder bösartige Anfragen an interne Ressourcen oder Server von Drittanbietern auszulösen.
01
describes (2)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2025-66516US | critical9.8 | Exploit | ||
Critical XXE in Apache Tika tika-core (1.13-3.2.1), tika-pdf-module (2.0.0-3.2.1) and tika-parsers (1.13-1.28.5) modules on all platforms allows an attacker to carry out XML Extern… | ||||
| CVE-2025-54988US | — | Exploit | ||
Critical XXE in Apache Tika (tika-parser-pdf-module) in Apache Tika 1.13 through and including 3.2.1 on all platforms allows an attacker to carry out XML External Entity injection… | ||||
02
references
External citations — patches, advisories, analysis.
- Red Hat Security Advisory RHSA-2025:23143 vom 2025-12-11external
- Red Hat Security Advisory RHSA-2025:23225 vom 2025-12-15external
- Red Hat Bugtracker #2389910 vom 2025-08-20external
- Atlassian Security Advisoryexternal
- Elastic Security Announcement ESA-2025-14 vom 2025-08-28external
- Elastic Security Announcement ESA-2025-15 vom 2025-08-28external
- GitHub Advisory Database vom 2025-12-04external
- PoC auf GitHub vom 2025-12-11external
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan