Vulnerability · Published Jul 14, 2025 · Assigned by apache
CVE-2025-53689Apache Jackrabbit: XXE vulnerability in jackrabbit-spi-commons
High 8.8
In plain English
A high-severity XML external entity in Apache Jackrabbit from Apache Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 46% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Blind XXE Vulnerabilities in jackrabbit-spi-commons and jackrabbit-core in Apache Jackrabbit < 2.23.2 due to usage of an unsecured document build to load privileges. Users are recommended to upgrade to versions 2.20.17 (Java 8), 2.22.1 (Java 11) or 2.23.2 (Java 11, beta versions), which fix this issue. Earlier versions (up to 2.20.16) are not supported anymore, thus users should update to the respective supported version.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | jackrabbit | no fix listed | DEBIAN-CVE-2025-53689 |
| Debian:13 | jackrabbit | 2.20.11-1.1 | DEBIAN-CVE-2025-53689 |
| Debian:14 | jackrabbit | 2.20.11-1.1 | DEBIAN-CVE-2025-53689 |
| Maven | org.apache.jackrabbit:jackrabbit-core | 2.20.17 | GHSA-44c3-38h8-9fh9 |
| Maven | org.apache.jackrabbit:jackrabbit-core | 2.23.2-beta | GHSA-44c3-38h8-9fh9 |
| Maven | org.apache.jackrabbit:jackrabbit-core | 2.22.1 | GHSA-44c3-38h8-9fh9 |
| Maven | org.apache.jackrabbit:jackrabbit-spi-commons | 2.23.2-beta | GHSA-44c3-38h8-9fh9 |
| Maven | org.apache.jackrabbit:jackrabbit-spi-commons | 2.20.17 | GHSA-44c3-38h8-9fh9 |
| Maven | org.apache.jackrabbit:jackrabbit-spi-commons | 2.22.1 | GHSA-44c3-38h8-9fh9 |
| Ubuntu:22.04:LTS | jackrabbit | no fix listed | UBUNTU-CVE-2025-53689 |
| Ubuntu:24.04:LTS | jackrabbit | no fix listed | UBUNTU-CVE-2025-53689 |
| Ubuntu:25.10 | jackrabbit | no fix listed | UBUNTU-CVE-2025-53689 |
| Ubuntu:26.04:LTS | jackrabbit | no fix listed | UBUNTU-CVE-2025-53689 |
| Ubuntu:26.10 | jackrabbit | no fix listed | UBUNTU-CVE-2025-53689 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Apache Software Foundation | Apache Jackrabbit | 2.20.0 – before 2.20.172.22.0 – before 2.22.12.23.0-beta – before 2.23.2-beta |
Weakness: CWE-611 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H