Applicability of CVE-2025-54988 to Clarity

Products

• Clarity PPM On Premise
• Clarity PPM SaaS

Issue/Introduction

Is Clarity impacted by CVE-2025-54988?

Environment

• Clarity 16.3.3
• Clarity 16.4.0

Resolution

Version 2.8.0 of tika-core.jar is present in the Clarity versions mentioned above. However, Clarity does not make use of the parser module. It only uses Apache Tika to detect mime type and do validation. Hence, this vulnerability does not impact Clarity.

Further, in Clarity 16.4.1, Apache Tika is upgraded to version 3.2.3.