Overview 

Sage CRM Quick Find uses Apache Solr, which bundles Apache Tika (tika-core) for content extraction from indexed documents, including PDFs. A vulnerability has been identified in the Apache Tika components. 

This advisory explains the vulnerability, affected versions, impact, and current workaround. 

What is happening? 

A vulnerability has been identified relating to CVE-2025-54988 / CVE-2025-66516, affecting the following Apache Tika modules: 

• tika-core (versions 1.13–3.2.1) 

• tika-pdf-module (versions 2.0.0–3.2.1) 

• tika-parsers (versions 1.13–1.28.5) 

These CVEs identify an XML External Entity (XXE) injection vulnerability that can be triggered via a crafted XFA (XML Forms Architecture) file embedded inside a PDF, on all platforms. 

Sage CRM 2026R1 ships with tika-core-1.28.4.jar, which falls within the affected version range. 

References 

• CVE-2025-54988: nvd.nist.gov/.../CVE-2025-54988 

• CVE-2025-66516: nvd.nist.gov/.../CVE-2025-66516 

Recommendation 

The following manual steps mitigate the vulnerability by disabling document content extraction in QuickFind:

1. Stop the QuickFind service. 
2. Navigate to: <Your CRM folder>\Services\QuickFind\server\solr\configsets\sample_techproducts_configs\conf\solrconfig.xml 
   • Comment out the <requestHandler name="/update/extract" ... class="solr.extraction.ExtractingRequestHandler">  block and its contents. 

3. Repeat the same change in: <Your CRM folder>\Services\QuickFind\templates\instance\conf\solrconfig.xml

• Comment out the corresponding requestHandler 

4. Navigate to: <Your CRM folder>\Services\QuickFind\contrib\extraction\lib

• Locate the Tika-related JAR files (approximately 6–8 files, depending on version) and delete them. 

5. Perform an IIS reset, verify if theQuickfind service has started successfully. In case it doesn't, start the service manually. 
6. Log in to CRM and confirm QuickFind search functionality is working as expected. 

Apply the workaround above on all CRM instances currently on affected Tika versions. 

This issue has been addressed in upcoming Sage CRM 2026R2 release. 

More Information 

Sage CRM doesn't use document indexing.  The vulnerable JAR files are still sitting statically inside the webapps directory (...\tomcat\webapps\solr\WEB-INF\lib\tika-core-1.28.4.jar). If an attacker gains enough local or network access to interact with the Solr instance directly via its default port (typically internal port 8983), they could potentially target the Solr ExtractingRequestHandler endpoint directly.