Atlassian Patches Critical Apache Tika Flaw

Atlassian has rolled out patches for roughly 30 third‑party vulnerabilities across Bamboo, Bitbucket, Confluence, Crowd, Fisheye/Crucible, Jira and Jira Service Management, with the standout fix addressing CVE-2025-66516, a critical XXE flaw in Apache Tika (CVSS 10/10) that affects tika-core, tika-pdf-module and tika-parsers. Disclosed in early December, the flaw can be exploited via crafted XFA files within PDF files, potentially leading to information leaks, denial-of-service, SSRF or remote code execution.

Atlassian notes that the fixes cover six products that use Tika, and the month’s other critical patching includes CVE-2022-37601, a prototype pollution issue in webpack loader-utils, as well as CVE-2021-39227 in ZRender affecting Jira and Jira Service Management. The updates address more than two dozen high‑severity DoS, XXE, SSRF, file inclusion, prototype pollution, improper authorization, information disclosure, improper input validation and RCE flaws, and were released for both data centre and server products.

Because the weaknesses stem from third‑party dependencies, they impact all Atlassian products that rely on them, and users are urged to apply the patches promptly, per Atlassian’s December 2025 security advisory.