---
title: "Security digest: August 20, 2025"
url: https://erroneo.us/security/2025-08-20/
description: "August 20, 2025 vulnerability digest: 3 critical advisories (RubyGems, Maven, npm). What to patch and who can relax."
type: security-digest-day
section: "Security Digest"
date_published: 2025-08-20
date_modified: 2025-08-20
publisher: erroneo.us
author: erroneo.us Security Desk
license: All rights reserved. Quote with attribution and a link.
---

# Security digest: August 20, 2025

3 critical advisories.

## Take stock

- RubyGems: 1 critical advisory ( spree , rd_searchlogic ). Check with bundle audit check --update .
- Maven: 1 critical advisory ( org.apache.tika:tika-parser-pdf-module , org.apache.tika:tika-parsers ). Check with mvn dependency:tree -Dincludes=<groupId>:<artifactId> .
- npm: 1 critical advisory ( directus , @directus/api ). Check with npm audit (or: npm ls <package>) .
- None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

## Known exploited (CISA KEV)

None.

## Critical advisories

- [CVE-2011-10026](https://erroneo.us/security/cve/CVE-2011-10026/index.md) Spree Commerce is vulnerable to RCE through Search API — RubyGems spree >= 0.30.0.beta1, < 0.50.0 → 0.50.0; RubyGems rd_searchlogic <= 3.0.1 → no fix
- [CVE-2025-54988](https://erroneo.us/security/cve/CVE-2025-54988/index.md) Apache Tika XXE Vulnerability via Crafted XFA File Inside a PDF — Maven org.apache.tika:tika-parser-pdf-module >= 1.13, < 3.2.2 → 3.2.2; Maven org.apache.tika:tika-parsers >= 1.13, < 2.0.0-ALPHA → 2.0.0-ALPHA
- [CVE-2025-55746](https://erroneo.us/security/cve/CVE-2025-55746/index.md) Directus allows unauthenticated file upload and file modification due to lacking input sanitization — npm directus >= 10.8.0, < 11.9.3 → 11.9.3; npm @directus/api >= 14.1.0, < 28.0.2 → 28.0.2

---
Source page: https://erroneo.us/security/2025-08-20/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt