CVE-2025-66516
Unknown Unknown - Not Provided
BaseFortify

Publication date: 2025-12-04

Last updated on: 2025-12-30

Assigner: Apache Software Foundation

Description
Critical XXE in Apache Tika tika-core (1.13-3.2.1), tika-pdf-module (2.0.0-3.2.1) and tika-parsers (1.13-1.28.5) modules on all platforms allows an attacker to carry out XML External Entity injection via a crafted XFA file inside of a PDF. This CVE covers the same vulnerability as in CVE-2025-54988. However, this CVE expands the scope of affected packages in two ways. First, while the entrypoint for the vulnerability was the tika-parser-pdf-module as reported in CVE-2025-54988, the vulnerability and its fix were in tika-core. Users who upgraded the tika-parser-pdf-module but did not upgrade tika-core to >= 3.2.2 would still be vulnerable. Second, the original report failed to mention that in the 1.x Tika releases, the PDFParser was in the "org.apache.tika:tika-parsers" module.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2025-12-04
Last Modified
2025-12-30
Generated
2026-05-07
AI Q&A
2025-12-04
EPSS Evaluated
2026-05-05
NVD
CVE-2025-66516
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
apache tika From 1.13 (inc) to 3.2.2 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-611 The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?

This vulnerability is a critical XML External Entity (XXE) injection flaw in Apache Tika's tika-core, tika-pdf-module, and tika-parsers modules. It allows an attacker to exploit the XML processing by crafting a malicious XFA file inside a PDF, which can trigger the XXE attack. This can lead to unauthorized access or manipulation of data during XML parsing.


How can this vulnerability impact me? :

The vulnerability can allow an attacker to execute XML External Entity injection attacks, potentially leading to unauthorized data access, data leakage, or denial of service. Because the CVSS score is 10.0 (critical), it indicates a high impact with no required privileges or user interaction, meaning an attacker can exploit it remotely and easily, severely compromising affected systems.


What immediate steps should I take to mitigate this vulnerability?

To mitigate this vulnerability, upgrade Apache Tika components to versions where tika-core is at least 3.2.2 or higher. Ensure that tika-core, tika-pdf-module, and tika-parsers are all updated to non-vulnerable versions to prevent XML External Entity injection via crafted XFA files inside PDFs.


Ask Our AI Assistant
Need more information? Ask your question to get an AI reply (Powered by our expertise)
0/70
EPSS Chart