Atlassian fixed maximum severity flaw CVE-2025-66516 in Apache Tika

Atlassian has released security updates addressing a maximum-severity flaw in Apache Tika, tracked as CVE-2025-66516, which carries a CVSS score of 10.0. The vulnerability enables an XML External Entity (XXE) injection by processing a crafted XFA file inside a PDF, potentially exposing sensitive internal resources.

The advisory notes that the issue affects Apache Tika core (org.apache.tika:tika-core) 1.13 through 3.2.1, the Apache Tika parsers (org.apache.tika:tika-parsers) 1.13 before 2.0.0, and the Apache Tika PDF parser module (org.apache.tika:tika-parser-pdf-module) 2.0.0 through 3.2.1.

It clarifies that the CVE describes the same vulnerability as CVE-2025-54988 but expands the scope of affected packages, since the root vulnerability and fix are in tika-core, and upgrading only the PDF module without tika-core to version 3.2.2 or later leaves systems vulnerable. The article also explains that older 1.x releases included PDFParser inside the tika-parsers module, broadening the set of affected components.