CVE-2025-54988: Apache Tika XXE vulnerability

Comments (1)

yakovsh2 · 5h ago

Critical XXE in Apache Tika (tika-parser-pdf-module) in Apache Tika 1.13 through and including 3.2.1 on all platforms allows an attacker to carry out XML External Entity injection via a crafted XFA file inside of a PDF. An attacker may be able to read sensitive data or trigger malicious requests to internal resources or third-party servers. Note that the tika-parser-pdf-module is used as a dependency in several Tika packages including at least: tika-parsers-standard-modules, tika-parsers-standard-package, tika-app, tika-grpc and tika-server-standard.

Users are recommended to upgrade to version 3.2.2, which fixes this issue.

Code review can be better (tigerbeetle.com)

SK hynix dethrones Samsung as world’s top DRAM maker (koreajoongangdaily.joins.com)

Show HN: I was curious about spherical helix, ended up making this visualization (visualrambling.space)

How to stop feeling lost in tech: the wafflehouse method (yacinemahdid.com)

A statistical analysis of Rotten Tomatoes (statsignificant.com)

Gemma 3 270M re-implemented in pure PyTorch for local tinkering (github.com)

Why are anime catgirls blocking my access to the Linux kernel? (lock.cmpxchg8b.com)

Show HN: PlutoPrint – Generate PDFs and PNGs from HTML with Python (github.com)

Launch HN: Channel3 (YC S25) – A database of every product on the internet

SimpleIDE (github.com)

Introduction to AT Protocol (mackuba.eu)

Zedless: Zed fork focused on privacy and being local-first (github.com)

An Update on Pytype (github.com)

Visualizing distributions with pepperoni pizza and JavaScript (ntietz.com)

Sequoia backs Zed (zed.dev)

Show HN: Luminal – Open-source, search-based GPU compiler (github.com)

Coris (YC S22) Is Hiring (ycombinator.com)

Pixel 10 Phones (blog.google)

OPA maintainers and Styra employees hired by Apple (blog.openpolicyagent.org)

Lean proof of Fermat's Last Theorem [pdf] (imperialcollegelondon.github.io)

Parallel Reduce and Scan on the GPU (cachemiss.xyz)

French firm Gouach is pitching an Infinite Battery with replaceable cells (arstechnica.com)

Vibe coding creates a bus factor of zero (mindflash.org)

Tidewave Web: in-browser coding agent for Rails and Phoenix (tidewave.ai)

Visualizing GPT-OSS-20B embeddings (melonmars.github.io)

Closer to the Metal: Leaving Playwright for CDP (browser-use.com)

AWS in 2025: Stuff you think you know that's now wrong (lastweekinaws.com)

Mirrorshades: The Cyberpunk Anthology (1986) (rudyrucker.com)

Learning about GPUs through measuring memory bandwidth (evolvebenchmark.com)

Understanding Moravec's Paradox (hexhowells.com)

The Rise and Fall of Music Ringtones: A Statistical Analysis (statsignificant.com)

Show HN: Anchor Relay – A faster, easier way to get Let's Encrypt certificates (anchor.dev)

Analysis of the GFW's Unconditional Port 443 Block on August 20, 2025 (gfw.report)

Linear scan register allocation on SSA (bernsteinbear.com)

Improvements to OCaml code editing: the basics of a refactor engine (tarides.com)

How to Draw a Space Invader (muffinman.io)

Databricks is raising a Series K Investment at >$100B valuation (databricks.com)

MapLibre Tile: A next generation geospatial format optimized for rendering (arxiv.org)

Show HN: Nestable.dev – local whiteboard app with nestable canvases, deep links (nestable.dev)

Best Options for Using AI in Chip Design (semiengineering.com)

Show HN: What country you would hit if you went straight where you're pointing (apps.apple.com)

The Block Stacking Problem (sites.pitt.edu)

Meta Freezes AI Hiring After Blockbuster Spending Spree (wsj.com)

Copilot broke audit logs, but Microsoft won't tell customers (pistachioapp.com)

Show HN: Project management system for Claude Code (github.com)

Modern CI is too complex and misdirected (2021) (gregoryszorc.com)

Ask HN: Why does the US Visa application website do a port-scan of my network?

AGENTS.md – Open format for guiding coding agents (agents.md)

Show HN: Bizcardz.ai – Custom metal business cards (github.com)

The End of Handwriting (wired.com)

CVE-2025-54988: Apache Tika XXE vulnerability

Comments (1)