The PDF Trap: Critical Vulnerability (CVE-2025-66516, CVSS 10.0) Hits Apache Tika Core

The PDF Trap reports a maximum-severity XML External Entity flaw in Apache Tika Core, tracked as CVE-2025-66516 with a CVSS of 10.0, which can be exploited by uploading a malicious PDF. The vulnerability arises from how Tika handles XFA data within PDFs, enabling XML External Entity injection via a crafted XFA file inside a PDF. The advisory notes that this affects the core engine beyond the previously disclosed CVE-2025-54988 and warns that upgrading only the PDF module is insufficient.

Affected components include Apache Tika Core versions 1.13 through 3.2.1, Apache Tika Parsers versions 1.13 before 2.0.0, and the Apache Tika PDF Parser Module versions 2.0.0 through 3.2.1, with the guidance that tika-core must be updated to at least 3.2.2. Administrators should treat tika-core 3.2.1 or older as vulnerable and upgrade immediately to mitigate disclosures of data, potential DoS, or SSRF risk.