CVE-2025-66516

Published Dec 4, 2025

Last updated a month ago

Overview

AI description

Automated description summarized from trusted sources.

CVE-2025-66516 is a vulnerability found in Apache Tika's tika-core (versions 1.13-3.2.1), tika-pdf-module (versions 2.0.0-3.2.1), and tika-parsers (versions 1.13-1.28.5). It involves an XML External Entity (XXE) injection flaw that can be exploited through a crafted XFA file embedded in a PDF document. This allows an attacker to interfere with the application's processing of XML data. The vulnerability can be triggered when Apache Tika processes a PDF file containing a malicious XFA component. This may allow an attacker to access local files, internal network resources, or other sensitive data on the server where Tika runs. To mitigate this vulnerability, it is recommended to upgrade tika-core to version 3.2.2 or later and to ensure all related Tika components are updated consistently.

Description: Critical XXE in Apache Tika tika-core (1.13-3.2.1), tika-pdf-module (2.0.0-3.2.1) and tika-parsers (1.13-1.28.5) modules on all platforms allows an attacker to carry out XML External Entity injection via a crafted XFA file inside of a PDF. This CVE covers the same vulnerability as in CVE-2025-54988. However, this CVE expands the scope of affected packages in two ways. First, while the entrypoint for the vulnerability was the tika-parser-pdf-module as reported in CVE-2025-54988, the vulnerability and its fix were in tika-core. Users who upgraded the tika-parser-pdf-module but did not upgrade tika-core to >= 3.2.2 would still be vulnerable. Second, the original report failed to mention that in the 1.x Tika releases, the PDFParser was in the "org.apache.tika:tika-parsers" module.
Source: security@apache.org
NVD status: Modified
Products: tika

Risk scores

CVSS 3.1

Type: Primary
Base score: 9.8
Impact score: 5.9
Exploitability score: 3.9
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Severity: CRITICAL

Weaknesses

security@apache.org: CWE-611

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:apache:tika:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "06E31452-81F9-4B50-A6E1-EE8FE3E148BD",
            "versionEndExcluding": "3.2.2",
            "versionStartIncluding": "1.13"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.