Apache Tika Core/Tika Parsers/Tika PDF Parser Module XFA File Parser xml external entity reference

Summaryinfo

A vulnerability labeled as problematic has been found in Apache Tika Core, Tika Parsers and Tika PDF Parser Module. This issue affects some unknown processing of the component XFA File Parser. Such manipulation leads to xml external entity reference. This vulnerability is documented as CVE-2025-66516. The attack can be executed remotely. There is not any exploit available. The affected component should be upgraded.

Detailsinfo

A vulnerability, which was classified as critical, has been found in Apache Tika Core, Tika Parsers and Tika PDF Parser Module (the affected version unknown). Affected by this issue is an unknown part of the component XFA File Parser. The manipulation with an unknown input leads to a xml external entity reference vulnerability. Using CWE to declare the problem leads to CWE-611. The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output. Impacted is confidentiality, integrity, and availability. CVE summarizes:

Critical XXE in Apache Tika tika-core (1.13-3.2.1), tika-pdf-module (2.0.0-3.2.1) and tika-parsers (1.13-1.28.5) modules on all platforms allows an attacker to carry out XML External Entity injection via a crafted XFA file inside of a PDF. This CVE covers the same vulnerability as in CVE-2025-54988. However, this CVE expands the scope of affected packages in two ways. First, while the entrypoint for the vulnerability was the tika-parser-pdf-module as reported in CVE-2025-54988, the vulnerability and its fix were in tika-core. Users who upgraded the tika-parser-pdf-module but did not upgrade tika-core to >= 3.2.2 would still be vulnerable. Second, the original report failed to mention that in the 1.x Tika releases, the PDFParser was in the "org.apache.tika:tika-parsers" module.

The advisory is shared for download at lists.apache.org. This vulnerability is handled as CVE-2025-66516 since 12/04/2025. The exploitation is known to be easy. The attack may be launched remotely. No form of authentication is required for exploitation. There are neither technical details nor an exploit publicly available. The current price for an exploit might be approx. USD $0-$5k (estimation calculated on 01/27/2026).

The vulnerability scanner Nessus provides a plugin with the ID 277526 (Linux Distros Unpatched Vulnerability : CVE-2025-66516), which helps to determine the existence of the flaw in a target environment.

Upgrading eliminates this vulnerability.

The vulnerability is also documented in the databases at Tenable (277526), EUVD (EUVD-2025-201189) and CERT Bund (WID-SEC-2025-1883). Once again VulDB remains the best source for vulnerability data.

Affected

• Debian Linux
• Red Hat Enterprise Linux
• IBM SPSS
• HCL Domino
• Apache Tika
• Open Source Elasticsearch
• Atlassian Bamboo
• Adobe ColdFusion

Productinfo

Vendor

• Apache

Name

• Tika Core
• Tika Parsers
• Tika PDF Parser Module

License

• open-source

Website

• Vendor: https://www.apache.org/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion