XXE (XML External Entity Injection) Tika Dependency in Jira Software Data Center and Server

XMLWordPrintable

    • Type: Public Security Vulnerability
    • Resolution: Fixed
    • Priority: High
    • 10.3.15, 11.2.0, 11.3.0
    • Affects Version/s: 9.12.0, 9.12.1, 9.12.2, 9.12.3, 9.12.4, 9.12.5, 9.12.6, 9.12.7, 9.12.8, 9.12.9, 9.12.10, 9.12.11, 9.12.12, 9.12.13, 9.12.14, 9.12.15, 9.12.16, 9.12.17, 9.12.18, 9.12.19, 9.12.20, 9.12.21, 9.12.22, 9.12.23, 9.12.24, 9.12.25, 9.12.26, 9.12.27, 9.12.28, 10.3.0, 10.3.1, 10.3.2, 10.3.3, 10.3.4, 10.3.5, 10.3.6, 10.3.7, 10.3.8, 10.3.9, 10.3.10, 10.3.11, 10.3.12, 10.3.13, 10.3.14, 11.0.0, 11.1.0, 11.0.1, 11.1.1
    • Component/s: Security
    • 10
    • Critical
    • CVE-2025-66516
    • Atlassian (Internal)
    • CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
    • XXE (XML External Entity Injection)
    • Jira Software Data Center, Jira Software Server

      This Jira Software release includes updates to our Apache Tika dependency in response to CVE-2025-66516.

      Our security team has assessed that the current scope of this CVE does not present the same critical risk in our products, as our use of the dependency doesn’t support the known path for exploitation.

      The patch for CVE-2025-66516 is being released out of an abundance of caution.

      This Critical severity XXE (XML External Entity Injection) vulnerability known as CVE-2025-66516 was introduced in 9.12.28 of Jira Software Data Center and Server.

      This vulnerability with a CVSS Score of 10 and a CVSS Vector of CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H allows an unauthenticated attacker to take actions which have high impact to confidentiality, high impact to integrity, high impact to availability, and requires no user interaction. 

      Atlassian recommends that Jira Software Data Center and Server customers upgrade to latest version, if you are unable to do so, upgrade your instance to one of the specified supported fixed versions:

      • Jira Software Data Center and Server 9.12: Upgrade to a release greater than or equal to 9.12.29
      • Jira Software Data Center and Server 10.3: Upgrade to a release greater than or equal to 10.3.15
      • Jira Software Data Center and Server 11.2: Upgrade to a release greater than or equal to 11.2.0

      See the release notes. You can download the latest version of Jira Software Data Center and Server from the download center.

      The National Vulnerability Database provides the following description for this vulnerability: Critical XXE in Apache Tika tika-core (1.13-3.2.1), tika-pdf-module (2.0.0-3.2.1) and tika-parsers (1.13-1.28.5) modules on all platforms allows an attacker to carry out XML External Entity injection via a crafted XFA file inside of a PDF. This CVE covers the same vulnerability as in CVE-2025-54988. However, this CVE expands the scope of affected packages in two ways. First, while the entrypoint for the vulnerability was the tika-parser-pdf-module as reported in CVE-2025-54988, the vulnerability and its fix were in tika-core. Users who upgraded the tika-parser-pdf-module but did not upgrade tika-core to >= 3.2.2 would still be vulnerable. Second, the original report failed to mention that in the 1.x Tika releases, the PDFParser was in the "org.apache.tika:tika-parsers" module.

            Assignee:
            Unassigned
            Reporter:
            Security Metrics Bot
            Votes:
            0 Vote for this issue
            Watchers:
            8 Start watching this issue

              Created:
              Updated:
              Resolved: