CVE-2025-54254

Published Aug 5, 2025

Last updated 18 hours ago

Overview

AI description

Automated description summarized from trusted sources.

CVE-2025-54254 is an XML External Entity (XXE) vulnerability that affects Adobe Experience Manager (AEM) Forms on JEE versions 6.5.23.0 and earlier. The vulnerability exists due to improper restrictions on XML external entity references. Successful exploitation could allow a remote, unauthenticated attacker to read sensitive files on the local file system. An attacker can send a specially crafted XML payload to trick the service into exposing local files without authentication.

Description: Adobe Experience Manager versions 6.5.23 and earlier are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could lead to arbitrary file system read. An attacker could exploit this vulnerability to access sensitive files on the local file system, scope is changed. Exploitation of this issue does not require user interaction.
Source: psirt@adobe.com
NVD status: Modified
Products: experience_manager_forms

Risk scores

CVSS 3.1

Type: Primary
Base score: 7.5
Impact score: 3.6
Exploitability score: 3.9
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Severity: HIGH

Weaknesses

psirt@adobe.com: CWE-611

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:adobe:experience_manager_forms:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "1449BBE4-7484-4972-8D04-BEC04C159F44",
            "versionEndIncluding": "6.5.23.0"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.