High severity8.8NVD Advisory· Published Jul 14, 2025· Updated Jun 17, 2026
CVE-2025-53689
CVE-2025-53689
Description
Blind XXE Vulnerabilities in jackrabbit-spi-commons and jackrabbit-core in Apache Jackrabbit < 2.23.2 due to usage of an unsecured document build to load privileges.
Users are recommended to upgrade to versions 2.20.17 (Java 8), 2.22.1 (Java 11) or 2.23.2 (Java 11, beta versions), which fix this issue. Earlier versions (up to 2.20.16) are not supported anymore, thus users should update to the respective supported version.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
org.apache.jackrabbit:jackrabbit-spi-commonsMaven | >= 2.20.0, < 2.20.17 | 2.20.17 |
org.apache.jackrabbit:jackrabbit-spi-commonsMaven | >= 2.22.0, < 2.22.1 | 2.22.1 |
org.apache.jackrabbit:jackrabbit-spi-commonsMaven | >= 2.23.0-beta, < 2.23.2-beta | 2.23.2-beta |
org.apache.jackrabbit:jackrabbit-coreMaven | >= 2.23.0-beta, < 2.23.2-beta | 2.23.2-beta |
org.apache.jackrabbit:jackrabbit-coreMaven | >= 2.20.0, < 2.20.17 | 2.20.17 |
org.apache.jackrabbit:jackrabbit-coreMaven | >= 2.22.0, < 2.22.1 | 2.22.1 |
Affected products
7cpe:2.3:a:apache:jackrabbit:*:*:*:*:*:*:*:*+ 4 more
- cpe:2.3:a:apache:jackrabbit:*:*:*:*:*:*:*:*range: >=2.20.0,<2.20.17
- cpe:2.3:a:apache:jackrabbit:2.22.0:*:*:*:*:*:*:*
- cpe:2.3:a:apache:jackrabbit:2.23.0:beta:*:*:*:*:*:*
- cpe:2.3:a:apache:jackrabbit:2.23.1:beta:*:*:*:*:*:*
- (no CPE)range: 2.20.0
- ghsa-coords2 versionspkg:maven/org.apache.jackrabbit/jackrabbit-corepkg:maven/org.apache.jackrabbit/jackrabbit-spi-commons
>= 2.23.0-beta, < 2.23.2-beta+ 1 more
- (no CPE)range: >= 2.23.0-beta, < 2.23.2-beta
- (no CPE)range: >= 2.20.0, < 2.20.17
Patches
Vulnerability mechanics
References
5- github.com/advisories/GHSA-44c3-38h8-9fh9ghsaADVISORY
- lists.apache.org/thread/5pf9n76ny13pzzk765og2h3gxdxw7p24nvdVendor AdvisoryWEB
- nvd.nist.gov/vuln/detail/CVE-2025-53689ghsaADVISORY
- www.openwall.com/lists/oss-security/2025/07/14/1nvdWEB
- github.com/apache/jackrabbit/pull/263/commits/02786c0a01838580252bdab79bfa54026c30294eghsaWEB
News mentions
0No linked articles in our index yet.