galoryber/cve-2025-54988-vulntikaprojectDeliberately vulnerable Spring Boot application using Apache Tika 3.2.1 for testing CVE-2025-54988 XXE exploitation via malicious PDF uploads.
This is a Spring Boot application that uses Apache Tika 3.2.1 for document processing and text extraction.
Have Docker
./start-app.sh
or docker compose up -d
Upload your malicious PDF (https://github.com/mgthuramoemyint/POC-CVE-2025-54988) to the endpoint to be extracted.
curl -X POST -F "[email protected]" http://127.0.0.1:8080/api/extract-text
curl -X POST -F "[email protected]" http://127.0.0.1:8080/api/detect-type
curl -X POST -F "[email protected]" http://127.0.0.1:8080/api/extract-pdf
Tika can be used to ID File Types. This capability does not appear to trigger the vulnerability.
When Tika is used to extract the data, it will trigger the XXE. This happens through either the tika objects .parseToString method or the PDFParser objects .parse method. Maybe there are more methods. It makes sense that the XXE would only be executed on a parser extract method.
CVE-2025-54988 CVE-2025-66516
