Apache Tika XXE Vulnerability

Apache Tika is a content analysis toolkit used by many applications to extract metadata from files. This vulnerability allows attackers to inject malicious XML code into PDF files, which can lead to arbitrary code execution on the server.

You're affected if you use Apache Tika tika-core version 1.13-3.2.1 or earlier, tika-pdf-module version 2.0.0-3.2.1, and tika-parsers version 1.13-1.28.5 on all platforms. Check with: find / -name "tika-core*.jar" or grep -r "tika-parser-pdf-module" pom.xml

Note: This vulnerability is similar to CVE-2025-54988, but it affects different modules and versions of Apache Tika.

1. Upgrade to Apache Tika 3.2.2 or later from the official Apache Software Foundation website.
2. If immediate upgrade isn't possible:
3. Set org.apache.tika.parser.pdfParser to false as a JVM flag.
4. Remove the org.apache.tika.parser.pdfParser class: zip -q -d tika-core-*.jar org/apache/tika/parser/pdf/Parser.class

• Third Party Advisory
• Vendor Advisory