Apache Tika vulnerability CVE-2025-66516 identified
A high-severity security flaw, CVE-2025-66516, has been identified in Apache Tika. It allows for XXE attacks through malicious PDF files.
Picus Security has identified a high-severity security vulnerability affecting Apache Tika, a widely used open-source framework for document parsing and metadata extraction. The flaw, designated CVE-2025-66516 with a CVSS score of 8.4, enables XML External Entity (XXE) attacks through specially crafted XFA files embedded within PDFs.
This disclosure supersedes the previously reported CVE-2025-54988. Investigations revealed that the vulnerability's root cause lies within the tika-core library, not solely the PDF module, expanding the scope of affected components. Because the flaw exists in the core logic, updating only the PDF parser module is insufficient for remediation.
Systems that process untrusted files are susceptible to significant risks, including sensitive local file exfiltration, server-side request forgery (SSRF), and denial of service (DoS). To address this threat, users must upgrade tika-core to version 3.2.2 or later. Versions 1.13 through 3.2.1 remain vulnerable.
Apache Tika is utilized across various sectors for its ability to process over a thousand file formats. XXE attacks exploit improperly configured XML parsers and can lead to the disclosure of confidential information, DoS, SSRF, and potentially arbitrary code execution if the system is not adequately secured.