Maximum-severity XXE vulnerability discovered in Apache Tika

A maximum severity XXE vulnerability in Apache Tika, tracked as CVE-2025-66516 (CVSS score of 10.0), allows XML external entity attacks by triggering an XXE injection in Tika’s core, PDF, and parser modules. An attacker can embed a malicious XFA file inside a PDF and trick Tika into processing external XML entities, opening access to sensitive internal resources.

Apache Tika is an open-source content analysis toolkit used to extract text, metadata and structured information from virtually any file type, and is deployed in systems such as search indexes and document ingestion pipelines. According to the advisory, the flaw spans multiple packages and is broader than earlier reports, with the root vulnerability and fix in tika-core; upgrading only the PDF module while not upgrading tika-core to version 3.2.2 or later leaves systems exposed.

The vulnerability affects Apache Tika core (org.apache.tika:tika-core) 1.13 through 3.2.1, Apache Tika parsers (org.apache.tika:tika-parsers) 1.13 before 2.0.0, and Apache Tika PDF parser module (org.apache.tika:tika-parser-pdf-module) 2.0.0 through 3.2.1. Users are urged to install the updates as soon as possible.