{
  "cveId": "CVE-2025-53689",
  "url": "https://patchblox.com/security/cve/CVE-2025-53689",
  "summary": "CVE-2025-53689 is fixed in jackrabbit on 1 platform, first by DEBIAN-CVE-2025-53689, released July 14, 2025. It is not reported as exploited. Patch Radar priority: High.",
  "title": "jackrabbit: Blind XXE Vulnerabilities in jackrabbit-spi-commons and jackrabbit-core in Apache Jackrabbit \u003C 2.23.2 due to usage of...",
  "description": "Blind XXE Vulnerabilities in jackrabbit-spi-commons and jackrabbit-core in Apache Jackrabbit \u003C 2.23.2 due to usage of an unsecured document build to load privileges.  Users are recommended to upgrade to versions 2.20.17 (Java 8), 2.22.1 (Java 11) or 2.23.2 (Java 11, beta versions), which fix this issue. Earlier versions (up to 2.20.16) are not supported anymore, thus users should update to the respective supported version.",
  "published": "2025-07-14T10:15:28Z",
  "severity": "high",
  "cvss": 8.8,
  "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
  "epss": 0.0054,
  "epssPercentile": 0.45692,
  "priority": "High",
  "priorityTier": 3,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "jackrabbit",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "2.20.11-1.1",
      "fix": "DEBIAN-CVE-2025-53689",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2025-53689",
      "released": "2025-07-14T10:15:28Z"
    },
    {
      "platform": "linux",
      "product": "jackrabbit",
      "release": "Debian 14",
      "fixedVersion": "2.20.11-1.1",
      "fix": "DEBIAN-CVE-2025-53689",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2025-53689",
      "released": "2025-07-14T10:15:28Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T06:59:42Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}