CVE-2025-54988 — Apache Tika PDF Parser XXE Injection

Key facts

CVE-2025-54988 (Apache) is a Critical (9.8) vulnerability: Apache Tika PDF Parser XXE Injection. This entry ships ready-to-deploy detection and prevention rules (Snort, YARA, Nginx, Apache) plus a detection-only PoC and a Docker test lab.

CVE	CVE-2025-54988
Severity	Critical (9.8)
Vendor	Apache
Detection / prevention	Snort, YARA, Nginx, Apache
PoC	poc.py
Source	2025/CVE-2025-54988/

Details

CVE-2025-54988 (Apache) is a Critical (9.8) vulnerability: Apache Tika PDF Parser XXE Injection. This entry ships a detection-only proof-of-concept (PoC), a Docker test lab, and ready-to-deploy detection and prevention rules (Snort, YARA, Nginx, Apache) — see Detection and prevention below. Source: NVD record.

Description

A critical XML External Entity (XXE) injection vulnerability exists in Apache Tika's PDF parser module (tika-parser-pdf-module). The vulnerability stems from improper handling of XML Forms Architecture (XFA) data within PDF files.

An attacker can carry out XXE injection via a crafted XFA file inside of a PDF document, potentially allowing: - Reading sensitive files from the server - Server-Side Request Forgery (SSRF) to internal resources - Malicious requests to third-party servers - Denial of Service attacks

CVSS v3.1 Score

9.8 CRITICAL - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Metric	Value
Attack Vector	Network
Attack Complexity	Low
Privileges Required	None
User Interaction	None
Scope	Unchanged
Confidentiality	High
Integrity	High
Availability	High

Affected Versions

• Apache Tika versions 1.13 through 3.2.1
• Affected packages:
• tika-parser-pdf-module
• tika-parsers-standard-modules
• tika-parsers-standard-package
• tika-app
• tika-grpc
• tika-server-standard

Affected Products

• Apache Tika
• HCL Notes versions 12, 14, and 14.5
• IBM Astronomer
• Apache JMeter (using vulnerable Tika dependencies)

Exploitation

The vulnerability is exploited by: 1. Creating a malicious PDF with embedded XFA (XML Forms Architecture) data 2. The XFA contains XXE payloads that reference external entities 3. When Apache Tika parses the PDF, it processes the XFA without proper XXE protections 4. External entities are resolved, leading to file disclosure or SSRF

Mitigation

1. Upgrade to Apache Tika version 3.2.2 or later
2. If immediate patching is not possible:
3. Use a Web Application Firewall (WAF)
4. Implement Intrusion Detection System (IDS) rules
5. Disable XFA parsing if not required
6. Restrict network access from Tika processing servers

Quick Start

# Build vulnerable environment
cd docker && docker-compose up -d

# Run PoC
python3 poc.py -t http://localhost:9998 -c

# Test with malicious PDF
python3 poc.py -t http://localhost:9998 --exploit --file /etc/passwd

Verification Process

The PoC uses a multi-stage verification approach:

Step 1: Product/Version Detection (Passive)

[*] Query target endpoint
[*] Detect product signatures and extract version
[*] Check if version is in vulnerable range

Step 2: Active Vulnerability Testing

Method	Description	Detection
Error-based	Tests for error messages indicating vulnerability	Error indicators in response
Timing-based	Measures response delay with payload	Response time significantly longer
Response-based	Checks for expected patterns in response	Vulnerability indicators present

Verification Flow

┌─────────────────────────────────────────────────────────────┐
│                    Product Detection                         │
│  Query target → Detect product/version                      │
│  Check if version in vulnerable range                       │
└─────────────────────────────────────────────────────────────┘
                              ↓
┌─────────────────────────────────────────────────────────────┐
│               Active Vulnerability Testing                   │
│                                                              │
│  1. Error-based Test                                         │
│     └─ Send payload → Check for error indicators            │
│     └─ If error found → CONFIRMED VULNERABLE                │
│                                                              │
│  2. Timing-based Test                                        │
│     └─ Send delay payload → Measure response time           │
│     └─ If delayed → CONFIRMED VULNERABLE                    │
│                                                              │
│  3. Response-based Test                                      │
│     └─ Send payload → Check response content                │
│     └─ If pattern matches → CONFIRMED VULNERABLE            │
└─────────────────────────────────────────────────────────────┘

Usage

# Full vulnerability check (version + active testing)
python3 poc.py -t https://target.com -c

# Version-only check (passive, no payloads sent)
python3 poc.py -t https://target.com -c --version-only

References

• NVD - CVE-2025-54988
• Apache Tika Security Advisory
• CWE-611: Improper Restriction of XXE
• IBM Security Bulletin

Timeline

• Discovered by: Amazon Security Researchers
• Disclosed: August 20, 2025
• Fixed in: Apache Tika 3.2.2

Detection and prevention

Ready-to-deploy defensive rules for CVE-2025-54988, for authorized testing and blue-team detection engineering:

• Snort IDS signature — prevention/snort.rules
• YARA detection rule — prevention/yara.yar
• Nginx mitigation — prevention/nginx.conf
• Apache HTTPD mitigation — prevention/httpd.conf
• Detection-only PoC — poc.py
• Rule notes — prevention/README.md

References: NVD — CVE-2025-54988 · full write-up on the searchable site

Detection & prevention rules

Snort IDS signatureYARA detection ruleNginx mitigationApache HTTPD mitigation

# CVE-2025-54988 - Apache Tika PDF Parser XXE Injection Snort Rules
# Severity: Critical (CVSS 9.8)
# CWE-611: Improper Restriction of XML External Entity Reference

# Detect XXE in PDF uploads - DOCTYPE with ENTITY
alert tcp $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS (
    msg:"CVE-2025-54988 Apache Tika XXE - DOCTYPE ENTITY in PDF";
    flow:to_server,established;
    content:"PUT"; http_method;
    content:"/tika"; http_uri;
    content:"application/pdf"; http_header;
    file_data;
    content:"<!DOCTYPE";
    content:"<!ENTITY";
    distance:0;
    classtype:web-application-attack;
    sid:2025549881;
    rev:1;
    metadata:cve CVE-2025-54988, severity critical, affected_product Apache_Tika;
    reference:cve,2025-54988;
    reference:url,nvd.nist.gov/vuln/detail/CVE-2025-54988;
)

# Detect XXE file:// protocol in PDF
alert tcp $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS (
    msg:"CVE-2025-54988 Apache Tika XXE - file:// Protocol";
    flow:to_server,established;
    content:"PUT"; http_method;
    file_data;
    content:"SYSTEM"; nocase;
    content:"file://"; distance:0; within:50;
    classtype:web-application-attack;
    sid:2025549882;
    rev:1;
    metadata:cve CVE-2025-54988, severity critical;
    reference:cve,2025-54988;
)

# Detect XXE http:// SSRF attempt
alert tcp $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS (
    msg:"CVE-2025-54988 Apache Tika XXE - SSRF via http://";
    flow:to_server,established;
    content:"PUT"; http_method;
    file_data;
    content:"SYSTEM"; nocase;
    content:"http://"; distance:0; within:50;
    classtype:web-application-attack;
    sid:2025549883;
    rev:1;
    metadata:cve CVE-2025-54988, severity critical;
    reference:cve,2025-54988;
)

# Detect XFA with XXE markers
alert tcp $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS (
    msg:"CVE-2025-54988 Apache Tika XXE - Malicious XFA in PDF";
    flow:to_server,established;
    content:"application/pdf"; http_header;
    file_data;
    content:"<xdp:xdp"; nocase;
    content:"<!ENTITY"; distance:0; within:500;
    classtype:web-application-attack;
    sid:2025549884;
    rev:1;
    metadata:cve CVE-2025-54988, severity critical;
    reference:cve,2025-54988;
)

# Detect XXE parameter entity
alert tcp $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS (
    msg:"CVE-2025-54988 Apache Tika XXE - Parameter Entity";
    flow:to_server,established;
    file_data;
    content:"%";
    pcre:"/<!ENTITY\s+%\s+\w+\s+SYSTEM/i";
    classtype:web-application-attack;
    sid:2025549885;
    rev:1;
    metadata:cve CVE-2025-54988, severity critical;
    reference:cve,2025-54988;
)

# Detect requests to Tika endpoints with suspicious payloads
alert tcp $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS (
    msg:"CVE-2025-54988 Apache Tika XXE - /etc/passwd Read Attempt";
    flow:to_server,established;
    content:"/tika"; http_uri;
    file_data;
    content:"/etc/passwd";
    classtype:web-application-attack;
    sid:2025549886;
    rev:1;
    metadata:cve CVE-2025-54988, severity critical;
    reference:cve,2025-54988;
)

# Detect cloud metadata SSRF attempts
alert tcp $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS (
    msg:"CVE-2025-54988 Apache Tika XXE - Cloud Metadata SSRF";
    flow:to_server,established;
    file_data;
    content:"169.254.169.254";
    classtype:web-application-attack;
    sid:2025549887;
    rev:1;
    metadata:cve CVE-2025-54988, severity critical;
    reference:cve,2025-54988;
)

# Detect billion laughs / XML bomb attempts
alert tcp $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS (
    msg:"CVE-2025-54988 Apache Tika XXE - XML Bomb/Billion Laughs";
    flow:to_server,established;
    file_data;
    content:"<!ENTITY";
    pcre:"/<!ENTITY\s+\w+\s+\"(&\w+;){5,}\"/";
    classtype:denial-of-service;
    sid:2025549888;
    rev:1;
    metadata:cve CVE-2025-54988, severity high;
    reference:cve,2025-54988;
)

# Detect external DTD loading
alert tcp $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS (
    msg:"CVE-2025-54988 Apache Tika XXE - External DTD Load";
    flow:to_server,established;
    file_data;
    content:"<!DOCTYPE";
    content:"SYSTEM"; distance:0; within:100;
    content:".dtd"; distance:0; within:200;
    classtype:web-application-attack;
    sid:2025549889;
    rev:1;
    metadata:cve CVE-2025-54988, severity high;
    reference:cve,2025-54988;
)

# Alert on vulnerable Tika version in responses
alert tcp $HOME_NET $HTTP_PORTS -> $EXTERNAL_NET any (
    msg:"CVE-2025-54988 Vulnerable Apache Tika Version Detected";
    flow:to_client,established;
    content:"Apache Tika"; nocase;
    pcre:"/Apache Tika (1\.(1[3-9]|[2-9]\d)|2\.\d+|3\.[0-1]|3\.2\.[01])/i";
    classtype:policy-violation;
    sid:2025549890;
    rev:1;
    metadata:cve CVE-2025-54988, severity medium;
    reference:cve,2025-54988;
)

:material-file-download: prevention/snort.rules

/*
 * CVE-2025-54988 - Apache Tika PDF Parser XXE Detection Rules
 * YARA rules for detecting malicious PDFs with XXE payloads
 *
 * Severity: Critical (CVSS 9.8)
 * CWE: CWE-611 (Improper Restriction of XML External Entity Reference)
 */

rule CVE_2025_54988_XXE_PDF_DOCTYPE {
    meta:
        description = "Detects PDF with XXE DOCTYPE declaration"
        author = "Security Research Team"
        severity = "critical"
        cve = "CVE-2025-54988"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-54988"
        date = "2025-08-20"

    strings:
        $pdf_header = "%PDF-"
        $doctype = "<!DOCTYPE" ascii wide nocase
        $entity = "<!ENTITY" ascii wide nocase
        $system = "SYSTEM" ascii wide nocase

    condition:
        $pdf_header at 0 and
        $doctype and
        ($entity or $system)
}

rule CVE_2025_54988_XXE_PDF_FileRead {
    meta:
        description = "Detects PDF XXE attempting file read"
        author = "Security Research Team"
        severity = "critical"
        cve = "CVE-2025-54988"

    strings:
        $pdf_header = "%PDF-"
        $file_proto1 = "file://" ascii wide nocase
        $file_proto2 = "file:\\\\" ascii wide nocase
        $sensitive1 = "/etc/passwd" ascii wide
        $sensitive2 = "/etc/shadow" ascii wide
        $sensitive3 = "C:\\Windows" ascii wide nocase
        $sensitive4 = "/proc/self" ascii wide
        $sensitive5 = ".ssh/id_rsa" ascii wide

    condition:
        $pdf_header at 0 and
        ($file_proto1 or $file_proto2) and
        any of ($sensitive*)
}

rule CVE_2025_54988_XXE_PDF_SSRF {
    meta:
        description = "Detects PDF XXE attempting SSRF"
        author = "Security Research Team"
        severity = "critical"
        cve = "CVE-2025-54988"

    strings:
        $pdf_header = "%PDF-"
        $http = "http://" ascii wide nocase
        $https = "https://" ascii wide nocase
        $system = "SYSTEM" ascii wide nocase
        $entity = "<!ENTITY" ascii wide nocase
        // Cloud metadata endpoints
        $aws_meta = "169.254.169.254" ascii wide
        $gcp_meta = "metadata.google.internal" ascii wide
        $azure_meta = "169.254.169.254/metadata" ascii wide
        // Internal networks
        $internal1 = "127.0.0.1" ascii wide
        $internal2 = "localhost" ascii wide nocase
        $internal3 = "10.0.0" ascii wide
        $internal4 = "192.168." ascii wide
        $internal5 = "172.16." ascii wide

    condition:
        $pdf_header at 0 and
        ($system or $entity) and
        ($http or $https) and
        any of ($aws_meta, $gcp_meta, $azure_meta, $internal*)
}

rule CVE_2025_54988_XXE_PDF_XFA {
    meta:
        description = "Detects PDF with malicious XFA containing XXE"
        author = "Security Research Team"
        severity = "critical"
        cve = "CVE-2025-54988"

    strings:
        $pdf_header = "%PDF-"
        $xfa1 = "<xdp:xdp" ascii wide nocase
        $xfa2 = "<xfa:" ascii wide nocase
        $xfa3 = "xmlns:xdp" ascii wide nocase
        $xfa4 = "xmlns:xfa" ascii wide nocase
        $xxe1 = "<!ENTITY" ascii wide nocase
        $xxe2 = "<!DOCTYPE" ascii wide nocase
        $xxe3 = "SYSTEM \"" ascii wide nocase
        $xxe4 = "PUBLIC \"" ascii wide nocase

    condition:
        $pdf_header at 0 and
        any of ($xfa*) and
        any of ($xxe*)
}

rule CVE_2025_54988_XXE_BillionLaughs {
    meta:
        description = "Detects XML bomb / billion laughs attack in PDF"
        author = "Security Research Team"
        severity = "high"
        cve = "CVE-2025-54988"

    strings:
        $pdf_header = "%PDF-"
        $entity = "<!ENTITY" ascii wide nocase
        // Patterns for entity expansion attacks
        $expand1 = /<!ENTITY\s+\w+\s+"(&\w+;){3,}"/ ascii wide nocase
        $expand2 = "&lol1;&lol1;&lol1;" ascii wide
        $expand3 = "&a;&a;&a;&a;" ascii wide

    condition:
        $pdf_header at 0 and
        $entity and
        any of ($expand*)
}

rule CVE_2025_54988_XXE_ParameterEntity {
    meta:
        description = "Detects XXE using parameter entities in PDF"
        author = "Security Research Team"
        severity = "critical"
        cve = "CVE-2025-54988"

    strings:
        $pdf_header = "%PDF-"
        $param_entity = /<!ENTITY\s+%\s+\w+\s+SYSTEM/ ascii wide nocase
        $use_param = /%\w+;/ ascii wide

    condition:
        $pdf_header at 0 and
        $param_entity and
        $use_param
}

rule CVE_2025_54988_XXE_OOB {
    meta:
        description = "Detects Out-of-Band XXE exfiltration attempt in PDF"
        author = "Security Research Team"
        severity = "critical"
        cve = "CVE-2025-54988"

    strings:
        $pdf_header = "%PDF-"
        $entity = "<!ENTITY" ascii wide nocase
        // OOB patterns
        $oob1 = "?data=" ascii wide
        $oob2 = "?exfil=" ascii wide
        $oob3 = "?file=" ascii wide
        $oob4 = "?content=" ascii wide
        $oob5 = /\?[a-z]+=&#x/ ascii wide nocase

    condition:
        $pdf_header at 0 and
        $entity and
        any of ($oob*)
}

rule CVE_2025_54988_Vulnerable_Tika_Jar {
    meta:
        description = "Detects vulnerable Apache Tika JAR files"
        author = "Security Research Team"
        severity = "high"
        cve = "CVE-2025-54988"

    strings:
        $jar_magic = { 50 4B 03 04 }
        $tika_class = "org/apache/tika/parser/pdf/PDFParser" ascii
        // Vulnerable version indicators
        $ver1 = "tika-parser-pdf-module" ascii
        $ver2 = "Implementation-Version: 3.2.1" ascii
        $ver3 = "Implementation-Version: 3.2.0" ascii
        $ver4 = "Implementation-Version: 3.1" ascii
        $ver5 = "Implementation-Version: 3.0" ascii
        $ver6 = "Implementation-Version: 2." ascii
        $ver7 = "Implementation-Version: 1.1" ascii
        $ver8 = "Implementation-Version: 1.2" ascii

    condition:
        $jar_magic at 0 and
        $tika_class and
        any of ($ver*)
}

:material-file-download: prevention/yara.yar

# CVE-2025-54988 - Apache Tika XXE Prevention Rules for Nginx
# Blocks malicious PDF uploads containing XXE payloads

# Rate limiting for Tika endpoints
limit_req_zone $binary_remote_addr zone=tika_limit:10m rate=10r/m;

# Upstream Tika server
upstream tika_backend {
    server 127.0.0.1:9998;
    keepalive 32;
}

server {
    listen 80;
    server_name tika.example.com;

    # Security headers
    add_header X-Content-Type-Options "nosniff" always;
    add_header X-Frame-Options "DENY" always;
    add_header X-XSS-Protection "1; mode=block" always;
    add_header Content-Security-Policy "default-src 'self'" always;

    # Logging for security analysis
    access_log /var/log/nginx/tika-access.log;
    error_log /var/log/nginx/tika-error.log;

    # Block requests with XXE indicators in body
    # Note: This requires ngx_http_lua_module or similar
    location /tika {
        # Rate limiting
        limit_req zone=tika_limit burst=5 nodelay;

        # Max upload size
        client_max_body_size 50M;

        # Only allow specific content types
        if ($content_type !~* "^application/(pdf|octet-stream)$") {
            return 415;
        }

        # Block requests with suspicious patterns in headers
        if ($http_user_agent ~* "(curl|wget|python|scanner|nikto)") {
            access_log /var/log/nginx/tika-blocked.log;
            # Uncomment to block: return 403;
        }

        # Proxy to Tika
        proxy_pass http://tika_backend;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

        # Timeout settings
        proxy_connect_timeout 30s;
        proxy_send_timeout 60s;
        proxy_read_timeout 120s;
    }

    # Block direct access to meta endpoint
    location /meta {
        limit_req zone=tika_limit burst=3 nodelay;
        client_max_body_size 50M;

        proxy_pass http://tika_backend;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
    }

    # Version endpoint (read-only)
    location /version {
        proxy_pass http://tika_backend;
        proxy_method GET;
    }

    # Block other endpoints
    location / {
        return 404;
    }
}

# ModSecurity/WAF rules (if using ModSecurity)
# SecRule REQUEST_BODY "@contains <!ENTITY" "id:2025549881,phase:2,deny,status:403,msg:'CVE-2025-54988 XXE attempt blocked'"
# SecRule REQUEST_BODY "@contains SYSTEM \"file:" "id:2025549882,phase:2,deny,status:403,msg:'CVE-2025-54988 file XXE blocked'"
# SecRule REQUEST_BODY "@contains SYSTEM \"http:" "id:2025549883,phase:2,deny,status:403,msg:'CVE-2025-54988 SSRF XXE blocked'"

:material-file-download: prevention/nginx.conf

# CVE-2025-54988 - Apache Tika XXE Prevention Rules for Apache httpd
# Use with mod_security for full protection

<VirtualHost *:80>
    ServerName tika.example.com

    # Proxy to Tika server
    ProxyPreserveHost On
    ProxyPass /tika http://127.0.0.1:9998/tika
    ProxyPassReverse /tika http://127.0.0.1:9998/tika
    ProxyPass /meta http://127.0.0.1:9998/meta
    ProxyPassReverse /meta http://127.0.0.1:9998/meta
    ProxyPass /version http://127.0.0.1:9998/version
    ProxyPassReverse /version http://127.0.0.1:9998/version

    # Security headers
    Header always set X-Content-Type-Options "nosniff"
    Header always set X-Frame-Options "DENY"
    Header always set X-XSS-Protection "1; mode=block"
    Header always set Content-Security-Policy "default-src 'self'"

    # Logging
    ErrorLog ${APACHE_LOG_DIR}/tika-error.log
    CustomLog ${APACHE_LOG_DIR}/tika-access.log combined

    # Rate limiting (requires mod_ratelimit)
    <Location "/tika">
        SetOutputFilter RATE_LIMIT
        SetEnv rate-limit 1024
    </Location>

    # File size limit
    LimitRequestBody 52428800

    # Block by content type
    <If "%{CONTENT_TYPE} !~ m#^application/(pdf|octet-stream)$#">
        <Location "/tika">
            Require all denied
        </Location>
    </If>
</VirtualHost>

# ModSecurity Rules for CVE-2025-54988
<IfModule security2_module>
    # Block XXE DOCTYPE declarations
    SecRule REQUEST_BODY "<!DOCTYPE" \
        "id:2025549881,\
        phase:2,\
        deny,\
        status:403,\
        log,\
        msg:'CVE-2025-54988: XXE DOCTYPE detected',\
        severity:CRITICAL,\
        tag:'CVE-2025-54988',\
        tag:'XXE'"

    # Block XXE ENTITY declarations
    SecRule REQUEST_BODY "<!ENTITY" \
        "id:2025549882,\
        phase:2,\
        deny,\
        status:403,\
        log,\
        msg:'CVE-2025-54988: XXE ENTITY detected',\
        severity:CRITICAL,\
        tag:'CVE-2025-54988',\
        tag:'XXE'"

    # Block file:// protocol
    SecRule REQUEST_BODY "@rx SYSTEM\s+[\"']file://" \
        "id:2025549883,\
        phase:2,\
        deny,\
        status:403,\
        log,\
        msg:'CVE-2025-54988: XXE file:// protocol detected',\
        severity:CRITICAL,\
        tag:'CVE-2025-54988',\
        tag:'XXE',\
        tag:'LFI'"

    # Block http:// SSRF attempts
    SecRule REQUEST_BODY "@rx SYSTEM\s+[\"']https?://" \
        "id:2025549884,\
        phase:2,\
        deny,\
        status:403,\
        log,\
        msg:'CVE-2025-54988: XXE SSRF attempt detected',\
        severity:CRITICAL,\
        tag:'CVE-2025-54988',\
        tag:'XXE',\
        tag:'SSRF'"

    # Block cloud metadata access
    SecRule REQUEST_BODY "@contains 169.254.169.254" \
        "id:2025549885,\
        phase:2,\
        deny,\
        status:403,\
        log,\
        msg:'CVE-2025-54988: Cloud metadata SSRF attempt',\
        severity:CRITICAL,\
        tag:'CVE-2025-54988',\
        tag:'SSRF',\
        tag:'CloudMetadata'"

    # Block sensitive file paths
    SecRule REQUEST_BODY "@rx /etc/(passwd|shadow|hosts)" \
        "id:2025549886,\
        phase:2,\
        deny,\
        status:403,\
        log,\
        msg:'CVE-2025-54988: Sensitive file read attempt',\
        severity:CRITICAL,\
        tag:'CVE-2025-54988',\
        tag:'XXE',\
        tag:'LFI'"

    # Block parameter entities
    SecRule REQUEST_BODY "@rx <!ENTITY\s+%" \
        "id:2025549887,\
        phase:2,\
        deny,\
        status:403,\
        log,\
        msg:'CVE-2025-54988: XXE parameter entity detected',\
        severity:CRITICAL,\
        tag:'CVE-2025-54988',\
        tag:'XXE'"
</IfModule>

:material-file-download: prevention/httpd.conf

Frequently asked questions

What is CVE-2025-54988?

CVE-2025-54988 (Apache) is a Critical (9.8) vulnerability: Apache Tika PDF Parser XXE Injection. This entry ships ready-to-deploy detection and prevention rules (Snort, YARA, Nginx, Apache) plus a detection-only PoC and a Docker test lab.

How do I detect CVE-2025-54988?

Deploy the Snort and YARA detection rule included with this entry (see Detection & prevention rules below), then validate it against the detection-only PoC in the Docker test lab.

How do I block or mitigate CVE-2025-54988?

Apply the Nginx and Apache mitigation config included with this entry, and upgrade to a fixed version per the vendor advisory (see the NVD record for affected versions).

Related CVEs

Other entries for the same vendor or product:

• CVE-2024-25065 — Apache OFBiz SSRF (Critical (9.8))
• CVE-2024-32113 — Apache OFBiz Path (Critical (9.8))
• CVE-2024-36104 — Apache OFBiz Bypass (Critical (9.8))
• CVE-2024-38476 — Apache HTTP Server SSRF (Critical (9.8))
• CVE-2024-38856 — Apache OFBiz Pre-Auth RCE (Critical (9.8))
• CVE-2024-41107 — CloudStack Auth Bypass (Critical (9.8))
• CVE-2024-45195 — Apache OFBiz Unauth RCE (Critical (9.8))
• CVE-2024-45216 — Solr Auth Bypass (Critical (9.8))

---

For authorized security testing and research only. See the full source and NVD record.