CVE-2025-53689 Apache Jackrabbit: XXE vulnerability in jackrabbit-spi-commons

What is CVE-2025-53689?

CVE-2025-53689 is a high-severity vulnerability in Apache Jackrabbit, published on 14 Jul 2025. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Blind XXE Vulnerabilities in jackrabbit-spi-commons and jackrabbit-core in Apache Jackrabbit < 2.23.2 due to usage of an unsecured document build to load privileges.

Users are recommended to upgrade to versions 2.20.17 (Java 8), 2.22.1 (Java 11) or 2.23.2 (Java 11, beta versions), which fix this issue. Earlier versions (up to 2.20.16) are not supported anymore, thus users should update to the respective supported version.

Weakness: CWE-611

Which versions are affected by CVE-2025-53689?

12 open source packages ship an affected version, including org.apache.jackrabbit:jackrabbit-core and org.apache.jackrabbit:jackrabbit-spi-commons. It affects 1 product.

Products include Apache Jackrabbit.

How do I fix CVE-2025-53689?

Upgrade org.apache.jackrabbit:jackrabbit-core to a fixed version for your release line: 2.20.17, 2.22.1 or 2.23.2-beta.

Is CVE-2025-53689 being exploited?

There is no known exploitation of CVE-2025-53689 in the wild and no public exploit code.

Other vulnerabilities in Apache Jackrabbit

• CVE-2023-37895 Apache Jackrabbit RMI access can lead to RCE Critical 9.8
• CVE-2026-92414 Apache Jackrabbit: Pre-auth hijack of cached sessions via derivable WebDAV lock tokens Critical 9.3
• CVE-2016-6801 Apache Jackrabbit Authentication Hijacking Vulnerability High 8.8
• CVE-2026-92415 Apache Jackrabbit: DavEx client runs Class.forName + (String)-constructor on server-controlled error bodies Medium 6.9
• CVE-2025-58782 Apache Jackrabbit Core, Apache Jackrabbit JCR Commons: JNDI injection risk with JndiRepositoryFactory Medium 6.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2025-53689, GHSA-44c3-38h8-9fh9, UBUNTU-CVE-2025-53689.