Atlassian fixed maximum severity flaw CVE-2025
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2021-39227 | ZRender is a lightweight graphic library providing 2d draw for Apache ECharts. ZRender is a lightweight graphic library providing 2d draw for Apache ECharts. In versions prior to 5.2.1, using `merge` and `clone` helper methods in the `src/core/util.ts` module results in prototype pollution. It affects the popular data visualization library Apache ECharts, which uses and exports these two methods directly. The GitHub Security Advisory page for this vulnerability contains a proof of concept. This issue is patched in ZRender version 5.2.1. One workaround is available: Check if there is `__proto__` in the object keys. Omit it before using it as an parameter in these affected methods. Or in `echarts.util.merge` and `setOption` if project is using ECharts. NVD description · AI analysis pending | 9.8 | 1% |
| — | ||
| CVE-2022-37601 | Prototype pollution vulnerability in function parseQuery in parseQuery.js in webpack loader-utils via the name variable in parseQuery.js. Prototype pollution vulnerability in function parseQuery in parseQuery.js in webpack loader-utils via the name variable in parseQuery.js. This affects all versions prior to 1.4.1 and 2.0.3. NVD description · AI analysis pending | 9.8 | 3% | PoC ×2 |
| — | |
| CVE-2025-54988 | Critical XXE in Apache Tika (tika-parser-pdf-module) in Apache Tika 1.13 through and including 3.2.1 on all platforms allows an attacker to carry out XML Extern Critical XXE in Apache Tika (tika-parser-pdf-module) in Apache Tika 1.13 through and including 3.2.1 on all platforms allows an attacker to carry out XML External Entity injection via a crafted XFA file inside of a PDF. An attacker may be able to read sensitive data or trigger malicious requests to internal resources or third-party servers. Note that the tika-parser-pdf-module is used as a dependency in several Tika packages including at least: tika-parsers-standard-modules, tika-parsers-standard-package, tika-app, tika-grpc and tika-server-standard. Users are recommended to upgrade to version 3.2.2, which fixes this issue. NVD description · AI analysis pending | 8.4 | 15% |
| — | ||
| CVE-2025-66516 | Critical XXE in Apache Tika PDF parsing via crafted XFA forms Apache Tika is vulnerable to XML External Entity (XXE) injection (CWE-611), rated critical at CVSS 9.8 (network-exploitable, no privileges or user interaction required), with the vulnerable code residing in tika-core but reachable through the PDF parser when it processes the XFA form embedded in a PDF. An attacker who can get Tika to parse a crafted PDF, typically by submitting a document to a Tika-based service or tika-server endpoint, can have the XML parser resolve external entities, gaining arbitrary local file read and SSRF from the Tika process, with CVSS impact rated high for confidentiality, integrity and availability. All platforms are affected across tika-core 1.13–3.2.1, tika-parser-pdf-module 2.0.0–3.2.1, and the 1.x tika-parsers module 1.13–1.28.5; notably the fix is in tika-core (3.2.2+), so upgrading only the PDF module leaves deployments vulnerable, and 1.x users need fixes in the tika-parsers module. Anyone running affected Tika versions to process untrusted PDFs is exposed, including standalone tika-server instances and downstream applications that embed Tika (vendors such as Atlassian have shipped fixes for embedded Tika). There is no CISA KEV listing and no public PoC or confirmed in-the-wild exploitation known, but EPSS puts it in the 100th percentile with an 80.3% probability of exploitation within 30 days. Do: Upgrade tika-core to 3.2.2 or later (upgrading only tika-parser-pdf-module is insufficient), and keep tika-parser-pdf-module aligned on the fixed 3.x line; users on the 1.x line should upgrade both tika-parsers and tika-core to the patched 1.x releases. If you consume Tika through another product (e.g., Solr-based stacks or Atlassian products), apply that vendor's patch. Until patched, avoid parsing untrusted PDFs with affected Tika versions, and restrict the Tika process's file-system and network access to limit file-read and SSRF impact. | 9.8 | 80% |
| mass≈100k+ exposed systems and plausibly millions of deployments/users (Tika is a ubiquitous Java document-parsing library bundled in Apache Solr, NiFi and… |
Full article734 words · extracted from securityaffairs.com · click to collapse
Pierluigi Paganini
December 15, 2025
Atlassian released security updates to address dozens of flaws, including multiple critical-severity vulnerabilities.
Atlassian addressed dozens of vulnerabilities impacting its products, including multiple critical-severity issues. One of the most severe bugs is a maximum-severity XML External Entity (XXE) injection flaw, tracked as CVE-2025-66516 (CVSS score of 10/10), in Apache Tika.
CVE-2025-66516 carries a maximum CVSS rating of 10.0 because it lets attackers trigger an XXE injection in Apache Tika’s core, PDF, and parser modules. An attacker can embed a malicious XFA file inside a PDF and trick Tika into processing external XML entities, opening a path to sensitive internal resources.
Apache Tika is an open-source content analysis toolkit used to extract text, metadata, and structured information from virtually any type of file. Tika is widely used in systems like search indexes, document ingestion pipelines (e.g., Apache Solr, Elasticsearch), compliance tools, and content analysis platforms.
“Critical XXE in Apache Tika tika-core (1.13-3.2.1), tika-pdf-module (2.0.0-3.2.1) and tika-parsers (1.13-1.28.5) modules on all platforms allows an attacker to carry out XML External Entity injection via a crafted XFA file inside of a PDF. This CVE covers the same vulnerability as in CVE-2025-54988.” reads the advisory. “However, this CVE expands the scope of affected packages in two ways. First, while the entrypoint for the vulnerability was the tika-parser-pdf-module as reported in CVE-2025-54988, the vulnerability and its fix were in tika-core. Users who upgraded the tika-parser-pdf-module but did not upgrade tika-core to >= 3.2.2 would still be vulnerable. Second, the original report failed to mention that in the 1.x Tika releases, the PDFParser was in the “org.apache.tika:tika-parsers” module.”
XXE injection (XML External Entity injection) is a type of security vulnerability that occurs when an application parses XML input insecurely and allows attackers to load external entities, special XML features that reference files or URLs outside the document.
The vulnerability affects the following versions:
- Apache Tika core (org.apache.tika:tika-core) 1.13 through 3.2.1
- Apache Tika parsers (org.apache.tika:tika-parsers) 1.13 before 2.0.0
- Apache Tika PDF parser module (org.apache.tika:tika-parser-pdf-module) 2.0.0 through 3.2.1
According to the advisory, the new CVE describes the same flaw as CVE-2025-54988 but clarifies that the issue is broader. Although it was initially linked to the PDF parser module, the root vulnerability and its fix are actually in tika-core, meaning anyone who updated only the PDF module without upgrading tika-core to version 3.2.2 or later remains exposed. It also notes that older Tika 1.x releases include PDFParser inside the tika-parsers module, expanding the set of affected packages beyond what the first advisory stated.
“This CVE covers the same vulnerability as in CVE-2025-54988. However, this CVE expands the scope of affected packages in two ways. First, while the entrypoint for the vulnerability was the tika-parser-pdf-module as reported in CVE-2025-54988, the vulnerability and its fix were in tika-core. Users who upgraded the tika-parser-pdf-module but did not upgrade tika-core to >= 3.2.2 would still be vulnerable.” “Second, the original report failed to mention that in the 1.x Tika releases, the PDFParser was in the “org.apache.tika:tika-parsers” module.”
The list of critical flaws addressed by Atlassian this month includes prototype pollution bugs in Confluence, Jira, and Jira Service Management, plus dozens of high-severity DoS, XXE, SSRF, file inclusion, and RCE issues.
One of these issues is a Prototype Pollution zrender Dependency in Jira Software Data Center and Server, tracked as CVE-2021-39227 (CVSS score of 9.8).
“ZRender is a lightweight graphic library providing 2d draw for Apache ECharts. In versions prior to 5.2.1, using `merge` and `clone` helper methods in the `src/core/util.ts` module results in prototype pollution. It affects the popular data visualization library Apache ECharts, which uses and exports these two methods directly. The GitHub Security Advisory page for this vulnerability contains a proof of concept. This issue is patched in ZRender version 5.2.1.” reads the advisory. “One workaround is available: Check if there is `__proto__` in the object keys. Omit it before using it as an parameter in these affected methods. Or in `echarts.util.merge` and `setOption` if project is using ECharts.”
The vendor also fixed another prototype pollution vulnerability, tracked as CVE-2022-37601, in function parseQuery in parseQuery.js in webpack loader-utils via the name variable in parseQuery.js. This flaw affects all versions prior to 1.4.1 and 2.0.3.
The list of vulnerabilities addressed this month is reported in the December 2025 security advisory.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, Apache Tika)
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/185710/security/atlassian-fixed-maximum-severity-flaw-cve-2025-66516-in-apache-tika.html