Critical Apache Tika Vulnerability Leads to XXE Injection

A critical-severity vulnerability in the Apache Tika open source analysis toolkit could allow XML External Entity (XXE) injection attacks, with the issue tracked as CVE-2025-66516 and a CVSS score of 10/10. Attackers can exploit the flaw via crafted XFA files placed inside PDF files on all platforms, enabling potential information leaks, SSRF attacks, denial-of-service, or remote code execution.

The advisory explains that the entry point was the tika-parser-pdf-module package, requiring updates to both tika-core and tika-parser-pdf-module to fully resolve the bug; the original report did not fully clarify that the PDF parser in the 1.x Tika releases was in the tika-parsers module. The newly disclosed vulnerability was patched in tika-core version 3.2.2, tika-parser-pdf-module version 3.2.2, and tika-parsers version 2.0.0, and users are advised to apply the patches as soon as possible.

According to Tim Allison, VP of Apache Tika, CVE-2025-66516 expands the scope of CVE-2025-54988, which was publicly disclosed in August. SecurityWeek notes that Apache Tika plays a central role in indexing and analysis tools, underscoring the risk to systems relying on the affected modules.