Document Properties
- ICM 7.10
- ICM 12
- ICM 11
- ICM 13
Security Information: Critical XXE Vulnerability in Apache Tika Used by ICM
We would like to inform our customers about a newly disclosed security issue affecting the external software library Apache Tika. Intershop uses the library apache‑tika‑core within the Intershop Commerce Management (ICM) system.
A critical XML External Entity (XXE) vulnerability has been identified in the following Apache Tika modules across all platforms:
- tika-core (1.13–3.2.1)
- tika-pdf-module (2.0.0–3.2.1)
- tika-parsers (1.13–1.28.5)
According to the CVE description, attackers may exploit this vulnerability by uploading specially crafted PDF files containing malicious XFA structures, potentially leading to the execution of harmful code (https://nvd.nist.gov/vuln/detail/CVE-2025-66516)
How Intershop is affected
- Intershop uses the affected library internally.
- The risk in our standard product is limited because the library is used only in the Backoffice, not in the public Storefront. The Backoffice is normally not accessible from the internet.
- The CVE states that the issue can be exploited via uploading PDF files that cause unwanted code execution.
- For more information, please refer to the official CVE entry.
- Why we are informing you:
- While the vulnerability is not critical in the standard configuration, we cannot fully assess how the library is used in individual customer projects.
- Therefore, we recommend reviewing your specific project setup.
Intershop will release updated ICM versions this week, which will include a fixed version of the library.
Recommended actions
For all customers running ICM versions newer than 7.10 (ICM 11, 12, 13):
Please wait for the upcoming ICM release that includes the updated Apache Tika library. Once available, install the updated version.
Recommendation for ICM 7.10 Customers:
Since the Apache Tika library cannot be updated on ICM 7.10 due to Java version limitations, we recommend disabling any custom Storefront features that use Apache Tika, especially those involving
PDF upload or processing.
This prevents potential exposure to the vulnerability.
ICM 14 is not affected.
Update – 17 December 2025
Intershop has released updated ICM versions that include the fixed Apache Tika library:
- ICM 13.5.0
- ICM 12.6.0
- ICM 11.12.0
find the related product landing pages here: https://knowledge.intershop.com/prd/index.php
ICM 7.10 Customers
A custom fix is available for ICM 7.10: CF with Jar file to address Tika CVE-2025-66516
Please place the provided library into the following directory: <server>/local/lib
Instructions on how to apply a Custom Fix can be found in the documentation: Cookbook – Deployment Tools ICM 7.10 Section 31. Recipe: Custom Fix Deployment
https://knowledge.intershop.com/kb/index.php/Display/286N26#Cookbook-DeploymentToolsICM7.10-Recipe:…
Disclaimer
The information provided in the Knowledge Base may not be applicable to all systems and situations. Intershop Communications will not be liable to any party for any direct or indirect damages resulting from the use of the Customer Support section of the Intershop Corporate Website, including, without limitation, any lost profits, business interruption, loss of programs or other data on your information handling system.