Critical XXE Bug CVE-2025-66516 (CVSS 10.0) Hits Apache Tika, Requires Urgent Patch

A critical security flaw has been disclosed in Apache Tika that could enable an XML external entity (XXE) injection attack, tracked as CVE-2025-66516, and rated 10.0 on the CVSS scale. According to an advisory for the vulnerability, the XXE can be carried out via a crafted XFA file inside a PDF and affects tika-core (1.13-3.2.1), tika-pdf-module (2.0.0-3.2.1) and tika-parsers (1.13-1.28.5) across all platforms.

The Apache Tika team notes that CVE-2025-66516 is assessed as the same as CVE-2025-54988, with the scope expanded to require users to upgrade both tika-core and the relevant modules to mitigate the issue, since upgrading only the parser module may leave some users vulnerable. Patched versions are 3.2.2 for tika-core and 3.2.2 for tika-pdf-module, with tika-parsers updated to 2.0.0. The guidance emphasises applying updates as soon as possible to mitigate potential threats, given the vulnerability’s severity.