What is CVE-2025-53689?

CVE-2025-53689 is a high-severity vulnerability in Apache Jackrabbit, classified under Improper Restriction of XML External Entity Reference (XXE). CVSS score: 8.8/10. Published 2025-07-14.

How severe is CVE-2025-53689?

High severity. CVSS v3 base score is 8.8 out of 10.

Is CVE-2025-53689 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

XXE in Apache Jackrabbit

CVE-2025-53689

Blind XXE Vulnerabilities in jackrabbit-spi-commons and jackrabbit-core in Apache Jackrabbit < 2.23.2 due to usage of an unsecured document build to load privileges. Users are recommended to upgrade to versions 2.20.17 (Java 8), 2.22.1 (Java 11) or 2.23.2 (Java 11, beta versions), which fix this issue. Earlier versions (up to 2.20.16) are not supported anymore, thus users should update to the respective supported version.

Vulnerability class: XXE (XML External Entity)

EPSS: 0.005 (41.0th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

Affected products

Apache Jackrabbit — versions 2.22.0, 2.23.0, 2.23.1
Apache Software Foundation Jackrabbit — versions 2.20.0, 2.22.0, 2.23.0-beta

Weakness classification (CWE)

CWE-611 — Improper Restriction of XML External Entity Reference (XXE)

Public proof-of-concept exploits

Threekiii/CVE

References

security@apache.org (vendor-advisory, Vendor Advisory)
af854a3a-2127-422b-91ae-364da2661108

Frequently asked questions

What is CVE-2025-53689?: CVE-2025-53689 is a high-severity vulnerability in Apache Jackrabbit, classified under Improper Restriction of XML External Entity Reference (XXE). CVSS score: 8.8/10. Published 2025-07-14.
How severe is CVE-2025-53689?: High severity. CVSS v3 base score is 8.8 out of 10.
Is CVE-2025-53689 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.