HCL Notes/Domino - Apache Tika Vulnerability (CVE-2025-54988)
Thomas Hampel
8 October 2025Certain versions of HCL Notes and Domino (but not all) are affected by the vulnerability in Apache Tika (CVE-2025-54988)
Apache Tika has an issue with indexing PDF attachments.
For context, the criticality for HCL Notes and Domino might be lower than what the CVE rating indicates because these products usually run in a non-priviliged (non-Root) environment.
Background:
Apache Tika is used in Domino for full-text indexing when:
1. indexing of attachments is enabled
>and<
2. conversion filters is enabled
see Database Properties:
Apache Tika is based on Java and updated versions of Tika have already been published by the maintainers of Tika for Java 11+
Just replacing the Tika files manually would technically work with Domino 14.0 and higher, but not with Domino 12.0.x and below as those versions are using Java 8
Tika no longer supports Java 8 - see this
Furthermore it is not recommended to manually replace files in the HCL product as it will break future updates and fixes because the installer is looking for file checksums.
Mitigation actions
Have been published already in these technotes:
- HCL Notes: KB0124165
- HCL Domino: KB0124164
However, customers are asking when they can expect a fix for the particular version they have in use.
We have just published a technote to set expectations for when (and if) a fix will be made available:
see KB0124451 - How to Configure Notes and Domino To Protect Against Apache Tika Vulnerability CVE-2025-54988
Updates are going to be provided only for the latest fixpack of each product version.
Current status:
The issue is fixed in:
- Download - Notes/Domino 14.5 Fix Pack 1
- Download - Notes/Domino 14.0 Fix Pack 4 Interim Fix 1 - for Win/Linux/AIX
Next up is to provide Fix Pack 7 for 12.0.2 FP7
additional details are provided in KB0124451
References:
- How to Configure Notes and Domino To Protect Against Apache Tika Vulnerability CVE-2025-54988
https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0124451
- Security Bulletin: HCL Notes is affected by an XML External Entity (XXE) vulnerability in Apache Tika (CVE-2025-54988)
https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0124165
- Security Bulletin: HCL Domino is affected by an XML External Entity (XXE) vulnerability in Apache Tika (CVE-2025-54988)
https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0124164
- Apache Tike Roadmap / End of life for Tika on Java8
https://cwiki.apache.org/confluence/display/TIKA/Tika+Roadmap+--+2.x%2C+3.x+and+Beyond