# CVE-2025-53689: Apache Jackrabbit: XXE vulnerability in jackrabbit-spi-commons

> CVE-2025-53689: Apache Jackrabbit: XXE vulnerability in jackrabbit-spi-commons. CVSS 8.8 (CVSS 3.1).

Canonical: https://rewindex.com/cve/CVE-2025-53689
Last updated: 2026-06-17T09:38:42Z

- Published: 2025-07-14 09:15 UTC · Updated: 2026-06-17 09:38 UTC · Assigner: apache
- CVSS: 8.8 (CVSS 3.1) · Severity: High · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- EPSS: 0.54%, 45th percentile (scored 2026-10-25)
- CISA KEV: no
- CWE: CWE-611

## Description

Blind XXE Vulnerabilities in jackrabbit-spi-commons and jackrabbit-core in Apache Jackrabbit \< 2.23.2 due to usage of an unsecured document build to load privileges. Users are recommended to upgrade to versions 2.20.17 (Java 8), 2.22.1 (Java 11) or 2.23.2 (Java 11, beta versions), which fix this issue. Earlier versions (up to 2.20.16) are not supported anymore, thus users should update to the respective supported version.

## Affected vendors and products

- Apache Software Foundation: Apache Jackrabbit

## Tracked companies

- [Confluence](https://rewindex.com/company/confluence.md)

## References

- [CVE record on cve.org](https://www.cve.org/CVERecord?id=CVE-2025-53689)
- [NVD entry](https://nvd.nist.gov/vuln/detail/CVE-2025-53689)
- [https://lists.apache.org/thread/5pf9n76ny13pzzk765og2h3gxdxw7p24](https://lists.apache.org/thread/5pf9n76ny13pzzk765og2h3gxdxw7p24)

---

_Sources: CVE records from the CVE Program (cve.org). CVE® is a registered trademark of The MITRE Corporation. (https://www.cve.org/) This product uses data from the NVD API but is not endorsed or certified by the NVD. (https://nvd.nist.gov/) Known Exploited Vulnerabilities catalog from CISA. (https://www.cisa.gov/known-exploited-vulnerabilities-catalog) EPSS scores from FIRST (Exploit Prediction Scoring System). (https://www.first.org/epss/)_


---
Canonical: https://rewindex.com/cve/CVE-2025-53689 · Markdown: https://rewindex.com/cve/CVE-2025-53689.md · JSON: https://rewindex.com/api/v1/cves/CVE-2025-53689 · Data licensed CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/) · Generated 2026-10-26T03:09:53.719Z