auxiliary/scanner/http/elasticsearch_tika_xfa_xxe

functional

Elasticsearch ingest-attachment Apache Tika XFA XXE Local File Read

view exploit source metasploittype auxiliarypublished 2025-08-20catalog metasploit

exploited CVEs (2)

Known CVEs related to this entry.

ID	severity	EPSS	exploitable	published
CVE-2025-66516US	critical9.8	89.0% (100th)	Exploit	2025-12-04
Critical XXE in Apache Tika tika-core (1.13-3.2.1), tika-pdf-module (2.0.0-3.2.1) and tika-parsers (1.13-1.28.5) modules on all platforms allows an attacker to carry out XML Extern…
CVE-2025-54988US	—	47.9% (99th)	Exploit	2025-08-20
Critical XXE in Apache Tika (tika-parser-pdf-module) in Apache Tika 1.13 through and including 3.2.1 on all platforms allows an attacker to carry out XML External Entity injection…

scry

Working exploits like this target internet-facing systems. See what is exposed on your perimeter with a free passive scan.