{"action":"Upgrade org.apache.tika:tika-parsers to 2.0.0-ALPHA or later.","affected":[{"fixed":"2.0.0-ALPHA","introduced":"1.13"}],"component":"org.apache.tika:tika-parsers","cve_ids":["CVE-2025-54988"],"ecosystem":"Maven","epss":0.47948,"exploited":false,"fixed_versions":["2.0.0-ALPHA"],"ghsa_id":"GHSA-p72g-pv48-7w9x","id":"tcs_01M5N96R6JA5J0PC7AMNJWYZJT","modified_at":"2026-09-10T03:50:27.356293343Z","published_at":"2025-08-20T21:30:27Z","references":["https://osv.dev/vulnerability/GHSA-p72g-pv48-7w9x","https://nvd.nist.gov/vuln/detail/CVE-2025-54988","https://github.com/apache/tika/pull/2291","https://github.com/apache/tika/commit/2b52257304f4d3cde2b8463657380bdb936d9ef2","https://archive.apache.org/dist/tika/3.2.2/CHANGES-3.2.2.txt","https://github.com/apache/tika","https://issues.apache.org/jira/browse/TIKA-4459","https://lists.apache.org/thread/8xn3rqy6kz5b3l1t83kcofkw0w4mmj1w","https://lists.apache.org/thread/stn9oh7rfn9yv76n1srxr9w56oy04p72","https://lists.debian.org/debian-lts-announce/2025/10/msg00030.html","http://www.openwall.com/lists/oss-security/2025/08/20/2","http://www.openwall.com/lists/oss-security/2025/08/20/3"],"severity":{"label":"critical","score":9.8},"sources":[{"source":"osv","source_id":"GHSA-p72g-pv48-7w9x#Maven/org.apache.tika:tika-parsers","url":"https://osv.dev/vulnerability/GHSA-p72g-pv48-7w9x"}],"summary":"Apache Tika XXE Vulnerability via Crafted XFA File Inside a PDF"}