CVE-2025-66516
Apache Tika core, Apache Tika parsers, Apache Tika PDF parser module: Update to CVE-2025-54988 to expand scope of artifacts affected
Critical XXE in Apache Tika tika-core (1.13-3.2.1), tika-pdf-module (2.0.0-3.2.1) and tika-parsers (1.13-1.28.5) modules on all platforms allows an attacker to carry out XML External Entity injection via a crafted XFA file inside of a PDF.
This CVE covers the same vulnerability as in CVE-2025-54988. However, this CVE expands the scope of affected packages in two ways.
First, while the entrypoint for the vulnerability was the tika-parser-pdf-module as reported in CVE-2025-54988, the vulnerability and its fix were in tika-core. Users who upgraded the tika-parser-pdf-module but did not upgrade tika-core to >= 3.2.2 would still be vulnerable.
Second, the original report failed to mention that in the 1.x Tika releases, the PDFParser was in the "org.apache.tika:tika-parsers" module.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Apache Tika core, Apache Tika parsers, Apache Tika PDF parser module: Update to CVE-2025-54988 to expand scope of artifacts affected
Critical XXE in Apache Tika tika-core (1.13-3.2.1), tika-pdf-module (2.0.0-3.2.1) and tika-parsers (1.13-1.28.5) modules on all platforms allows an attacker to carry out XML External Entity injection via a crafted XFA file inside of a PDF.
This CVE covers the same vulnerability as in CVE-2025-54988. However, this CVE expands the scope of affected packages in two ways.
First, while the entrypoint for the vulnerability was the tika-parser-pdf-module as reported in CVE-2025-54988, the vulnerability and its fix were in tika-core. Users who upgraded the tika-parser-pdf-module but did not upgrade tika-core to >= 3.2.2 would still be vulnerable.
Second, the original report failed to mention that in the 1.x Tika releases, the PDFParser was in the "org.apache.tika:tika-parsers" module.
- Record
CVE-2025-66516- CVSS 3.1
- 8.4 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-611
- Updated
- 2026-11-02
EUVDEUVD-2025-201189
Critical XXE in Apache Tika tika-core (1.13-3.2.1), tika-pdf-module (2.0.0-3.2.1) and tika-parsers (1.13-1.28.5) modules on all platforms allows an attacker to carry out XML External Entity injection via a crafted XFA file inside of a PDF.
This CVE covers the same vulnerability as in CVE-2025-54988. However, this CVE expands the scope of affected packages in two ways.
First, while the entrypoint for the vulnerability was the tika-parser-pdf-module as reported in CVE-2025-54988, the vulnerability and its fix were in tika-core. Users who upgraded the tika-parser-pdf-module but did not upgrade tika-core to >= 3.2.2 would still be vulnerable.
Second, the original report failed to mention that in the 1.x Tika releases, the PDFParser was in the "org.apache.tika:tika-parsers" module.
- Record
EUVD-2025-201189- CVSS 3.1
- 8.4 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-f58c-gq56-vjjf
Apache Tika has XXE vulnerability
Critical XXE in Apache Tika tika-core (1.13-3.2.1), tika-pdf-module (2.0.0-3.2.1) and tika-parsers (1.13-1.28.5) modules on all platforms allows an attacker to carry out XML External Entity injection via a crafted XFA file inside of a PDF.
This CVE covers the same vulnerability as in CVE-2025-54988. However, this CVE expands the scope of affected packages in two ways.
First, while the entrypoint for the vulnerability was the tika-parser-pdf-module as reported in CVE-2025-54988, the vulnerability and its fix were in tika-core. Users who upgraded the tika-parser-pdf-module but did not upgrade tika-core to >= 3.2.2 would still be vulnerable.
Second, the original report failed to mention that in the 1.x Tika releases, the PDFParser was in the "org.apache.tika:tika-parsers" module.
- Record
GHSA-f58c-gq56-vjjf- CVSS 4.0
- 10.0 Critical
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H - Weakness
- CWE-611
- Updated
- 2026-11-02
NVD
Critical XXE in Apache Tika tika-core (1.13-3.2.1), tika-pdf-module (2.0.0-3.2.1) and tika-parsers (1.13-1.28.5) modules on all platforms allows an attacker to carry out XML External Entity injection via a crafted XFA file inside of a PDF.
This CVE covers the same vulnerability as in CVE-2025-54988. However, this CVE expands the scope of affected packages in two ways.
First, while the entrypoint for the vulnerability was the tika-parser-pdf-module as reported in CVE-2025-54988, the vulnerability and its fix were in tika-core. Users who upgraded the tika-parser-pdf-module but did not upgrade tika-core to >= 3.2.2 would still be vulnerable.
Second, the original report failed to mention that in the 1.x Tika releases, the PDFParser was in the "org.apache.tika:tika-parsers" module.
- Record
CVE-2025-66516- CVSS 3.1
- 8.4 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-611
- Updated
- 2026-11-02
OSV
Apache Tika core, Apache Tika parsers, Apache Tika PDF parser module: Update to CVE-2025-54988 to expand scope of artifacts affected
Critical XXE in Apache Tika tika-core (1.13-3.2.1), tika-pdf-module (2.0.0-3.2.1) and tika-parsers (1.13-1.28.5) modules on all platforms allows an attacker to carry out XML External Entity injection via a crafted XFA file inside of a PDF.
This CVE covers the same vulnerability as in CVE-2025-54988. However, this CVE expands the scope of affected packages in two ways.
First, while the entrypoint for the vulnerability was the tika-parser-pdf-module as reported in CVE-2025-54988, the vulnerability and its fix were in tika-core. Users who upgraded the tika-parser-pdf-module but did not upgrade tika-core to >= 3.2.2 would still be vulnerable.
Second, the original report failed to mention that in the 1.x Tika releases, the PDFParser was in the "org.apache.tika:tika-parsers" module.
- Record
CVE-2025-66516- CVSS 3.1
- 8.4 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-611
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2025-66516
Critical XXE in Apache Tika tika-core (1.13-3.2.1), tika-pdf-module (2.0.0-3.2.1) and tika-parsers (1.13-1.28.5) modules on all platforms allows an attacker to carry out XML External Entity injection via a crafted XFA file inside of a PDF. This CVE covers the same vulnerability as in CVE-2025-54988. However, this CVE expands the scope of affected packages in two ways. First, while the entrypoint for the vulnerability was the tika-parser-pdf-module as reported in CVE-2025-54988, the vulnerability and its fix were in tika-core. Users who upgraded the tika-parser-pdf-module but did not upgrade tika-core to >= 3.2.2 would still be vulnerable. Second, the original report failed to mention that in the 1.x Tika releases, the PDFParser was in the "org.apache.tika:tika-parsers" module.
- Record
DEBIAN-CVE-2025-66516- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Show 5 moreShow less
OSVGHSA-f58c-gq56-vjjf
Apache Tika has XXE vulnerability
Critical XXE in Apache Tika tika-core (1.13-3.2.1), tika-pdf-module (2.0.0-3.2.1) and tika-parsers (1.13-1.28.5) modules on all platforms allows an attacker to carry out XML External Entity injection via a crafted XFA file inside of a PDF.
This CVE covers the same vulnerability as in CVE-2025-54988. However, this CVE expands the scope of affected packages in two ways.
First, while the entrypoint for the vulnerability was the tika-parser-pdf-module as reported in CVE-2025-54988, the vulnerability and its fix were in tika-core. Users who upgraded the tika-parser-pdf-module but did not upgrade tika-core to >= 3.2.2 would still be vulnerable.
Second, the original report failed to mention that in the 1.x Tika releases, the PDFParser was in the "org.apache.tika:tika-parsers" module.
- Record
GHSA-f58c-gq56-vjjf- CVSS 4.0
- 10.0 Critical
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H - Weakness
- CWE-611
- Updated
- 2026-11-02
OSVROOT-APP-MAVEN-CVE-2025-66516
CVE-2025-66516 in io.root.org.apache.tika:tika-parser-pdf-module - Patched by Root
Root has patched CVE-2025-66516 in the io.root.org.apache.tika:tika-parser-pdf-module package for Root:Maven. Multiple fixed versions available.
- Record
ROOT-APP-MAVEN-CVE-2025-66516- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2025-66516
Critical XXE in Apache Tika tika-core (1.13-3.2.1), tika-pdf-module (2.0.0-3.2.1) and tika-parsers (1.13-1.28.5) modules on all platforms allows an attacker to carry out XML External Entity injection via a crafted XFA file inside of a PDF. This CVE covers the same vulnerability as in CVE-2025-54988. However, this CVE expands the scope of affected packages in two ways. First, while the entrypoint for the vulnerability was the tika-parser-pdf-module as reported in CVE-2025-54988, the vulnerability and its fix were in tika-core. Users who upgraded the tika-parser-pdf-module but did not upgrade tika-core to >= 3.2.2 would still be vulnerable. Second, the original report failed to mention that in the 1.x Tika releases, the PDFParser was in the "org.apache.tika:tika-parsers" module.
- Record
UBUNTU-CVE-2025-66516- CVSS 4.0
- 10.0 Critical
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H - CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 3.1
- 8.4 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-04
OSVCLSA-2026-1777596014 No score
TuxCare security update for org.apache.tika (2 CVEs)
TuxCare rebuilt 3 org.apache.tika packages to address 2 CVEs. Fixed in 2.9.4-tuxcare.1.
- Record
CLSA-2026-1777596014- Updated
- 2026-11-02
OSVUSN-8324-1 No score
tika vulnerabilities
It was discovered that Apache Tika incorrectly handled XML external entities when parsing XFA content in PDF files. An attacker could possibly use this issue to obtain sensitive information or send malicious requests to internal resources or third-party servers.
- Record
USN-8324-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.apache.tika:tika-coreMaven |
1.13 to 3.2.1 | 3.2.2 |
org.apache.tika:tika-parsersMaven |
1.13 up to 2.0.0 | 2.0.0 |
org.apache.tika:tika-parser-pdf-moduleMaven |
2.0.0 to 3.2.1 | 3.2.2 |
org.apache.tika:tika-coreTuxCare:Maven From an advisory covering 2 CVEs |
2.9.4 up to 2.9.4-tuxcare.1 | 2.9.4-tuxcare.1 |
org.apache.tika:tika-parser-pdf-moduleTuxCare:Maven From an advisory covering 2 CVEs |
2.9.4 up to 2.9.4-tuxcare.1 | 2.9.4-tuxcare.1 |
org.apache.tika:tika-parsersTuxCare:Maven From an advisory covering 2 CVEs |
2.9.4 up to 2.9.4-tuxcare.1 | 2.9.4-tuxcare.1 |
tikaDebian:11 |
before 1.22-2+deb11u1, plus listed versions 1.22-2 |
1.22-2+deb11u1 |
tikaDebian:11 From an advisory covering 2 CVEs |
before 1.22-2+deb11u1, plus listed versions 1.22-2 |
1.22-2+deb11u1 |
org.apache.tika:tika-coreMaven |
1.13 up to 3.2.2, plus listed versions 1.141.151.161.171.18 Show 41 moreShow less1.191.19.11.201.211.221.231.241.24.11.251.261.271.281.28.11.28.21.28.31.28.41.28.52.0.02.0.0-ALPHA2.0.0-BETA2.1.02.2.02.2.12.3.02.4.02.4.12.5.02.6.02.7.02.8.02.9.02.9.12.9.22.9.32.9.43.0.03.0.0-BETA3.0.0-BETA23.1.03.2.03.2.1 |
3.2.2 |
org.apache.tika:tika-parsersMaven |
1.13 up to 2.0.0, plus listed versions 1.141.151.161.171.18 Show 19 moreShow less1.191.19.11.201.211.221.231.241.24.11.251.261.271.281.28.11.28.21.28.31.28.41.28.52.0.0-ALPHA2.0.0-BETA |
2.0.0 |
Show 11 moreShow less
| Package | Affected | Fixed |
|---|---|---|
org.apache.tika:tika-parser-pdf-moduleMaven |
2.0.0 up to 3.2.2, plus listed versions 2.1.02.2.02.2.12.3.02.4.0 Show 16 moreShow less2.4.12.5.02.6.02.7.02.8.02.9.02.9.12.9.22.9.32.9.43.0.03.0.0-BETA3.0.0-BETA23.1.03.2.03.2.1 |
3.2.2 |
io.root.org.apache.tika:tika-parser-pdf-moduleRoot:Maven |
before 2.9.2-root.io.1 | 2.9.2-root.io.12.9.2-root.io.22.9.2-root.io.52.9.2-root.io.62.9.2-root.io.42.9.3-root.io.1 |
io.root.org.apache.tika:tika-coreRoot:Maven |
before 2.9.2-root.io.5 | 2.9.2-root.io.52.9.2-root.io.62.9.2-root.io.42.9.3-root.io.1 |
tikaUbuntu:Pro:20.04:LTS |
before 1.22-1ubuntu0.1~esm2, plus listed versions 1.22-11.22-1ubuntu0.1~esm1 |
1.22-1ubuntu0.1~esm2 |
tikaUbuntu:22.04:LTS |
before 1.22-2+deb11u1build0.22.04.1, plus listed versions 1.22-2 |
1.22-2+deb11u1build0.22.04.1 |
tikaUbuntu:24.04:LTS |
All versions, plus listed versions 1.22-2 |
None known |
tikaUbuntu:25.10 |
All versions, plus listed versions 1.22-2 |
None known |
tikaUbuntu:26.10 |
All versions, plus listed versions 1.22-2 |
None known |
tikaUbuntu:26.04:LTS |
All versions, plus listed versions 1.22-2 |
None known |
tikaUbuntu:Pro:20.04:LTS From an advisory covering 2 CVEs |
before 1.22-1ubuntu0.1~esm2, plus listed versions 1.22-11.22-1ubuntu0.1~esm1 |
1.22-1ubuntu0.1~esm2 |
tikaUbuntu:22.04:LTS From an advisory covering 2 CVEs |
before 1.22-2+deb11u1build0.22.04.1, plus listed versions 1.22-2 |
1.22-2+deb11u1build0.22.04.1 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| PoC in GitHub | chasingimpact/CVE-2025-66516-Writeup-POC | 2025-12-12 |
| PoC in GitHub | sid6224/CVE-2025-66516-POC | 2025-12-17 |
| PoC in GitHub | intSheep/Tika-CVE-2025-66516-Lab | 2025-12-19 |
| Metasploit | Elasticsearch ingest-attachment Apache Tika XFA XXE Local File Read | 2025-08-20 |
| Nuclei | Apache Tika - XML External Entity Injection |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | ||
| affected, exploits, facts | OSV | |
| first indexed | CVE List, EUVD, GitHub Advisories, Metasploit, Nuclei, NVD, OSV, PoC in GitHub |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2025-66516 is a high vulnerability (CVSS 8.4) in Apache Tika, published October 26, 2025. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 89.0%, the 99th percentile. Fixed in org.apache.tika:tika-core 3.2.2.