CVE-2025-53689
High
Description
Blind XXE Vulnerabilities in jackrabbit-spi-commons and jackrabbit-core in Apache Jackrabbit < 2.23.2 due to usage of an unsecured document build to load privileges. Users are recommended to upgrade to versions 2.20.17 (Java 8), 2.22.1 (Java 11) or 2.23.2 (Java 11, beta versions), which fix this issue. Earlier versions (up to 2.20.16) are not supported anymore, thus users should update to the respective supported version.
SeverityHigh
CVSS8.8
Exploit probability—
Product
Apache Jackrabbit
PublishedJul 14, 2025
First seenJul 14, 2025
Weakness typeCWE-611XML external entity (XXE)
How to fix
Update
- apache jackrabbit2.20.17 or later
- org.apache.jackrabbit:jackrabbit-spi-commons2.20.17, 2.22.1, 2.23.2-beta or later
- org.apache.jackrabbit:jackrabbit-core2.23.2-beta, 2.20.17, 2.22.1 or later
Vendor advisories
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| apache jackrabbit | 2.20.0 ≤ v < 2.20.17, 2.22.0, 2.23.0, 2.23.1 | 2.20.17 |
| org.apache.jackrabbit:jackrabbit-spi-commonsMaven | 2.20.0 ≤ v < 2.20.17, 2.22.0 ≤ v < 2.22.1, 2.23.0-beta ≤ v < 2.23.2-beta | 2.20.17, 2.22.1, 2.23.2-beta |
| org.apache.jackrabbit:jackrabbit-coreMaven | 2.23.0-beta ≤ v < 2.23.2-beta, 2.20.0 ≤ v < 2.20.17, 2.22.0 ≤ v < 2.22.1 | 2.23.2-beta, 2.20.17, 2.22.1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.