{"id":"CVE-2025-66516","published":"2025-12-04T16:17:24Z","modified":"2026-02-26T16:57:34Z","title":"Apache Tika core, Apache Tika parsers, Apache Tika PDF parser module: Update to CVE-2025-54988 to expand scope of…","vendor":"Apache Software Foundation","product":"Apache Tika core","tier":"core","eol":null,"affectedVersions":[{"vendor":"Apache Software Foundation","product":"Apache Tika core","versions":[">= 1.13, <= 3.2.1"]},{"vendor":"Apache Software Foundation","product":"Apache Tika parsers","versions":[">= 1.13, < 2.0.0"]},{"vendor":"Apache Software Foundation","product":"Apache Tika PDF parser module","versions":[">= 2.0.0, <= 3.2.1"]}],"description":{"text":"Critical XXE in Apache Tika tika-core (1.13-3.2.1), tika-pdf-module (2.0.0-3.2.1) and tika-parsers (1.13-1.28.5) modules on all platforms allows an attacker to carry out XML External Entity injection via a crafted XFA file inside of a PDF. \n\nThis CVE covers the same vulnerability as in CVE-2025-54988. However, this CVE expands the scope of affected packages in two ways. \n\nFirst, while the entrypoint for the vulnerability was the tika-parser-pdf-module as reported in CVE-2025-54988, the vulnerability and its fix were in tika-core. Users who upgraded the tika-parser-pdf-module but did not upgrade tika-core to >= 3.2.2 would still be vulnerable. \n\nSecond, the original report failed to mention that in the 1.x Tika releases, the PDFParser was in the \"org.apache.tika:tika-parsers\" module.","provenance":"source","from":"CVE.org"},"summary":null,"cvss":{"score":8.4,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.88976,"percentile":0.99778,"date":"2026-10-29","provenance":"source"},"kev":null,"vulncheckKev":null,"exploited":false,"otx":{"pulseCount":6,"pulses":[{"name":"ACTUALIZACION | Oracle Critical Patch Update Advisory - April 2026","url":"https://otx.alienvault.com/pulse/6a04aeed763730d81a39cece","created":"2026-05-13"},{"name":"Sneeit WordPress RCE Exploited in the Wild While ICTBroadcast Bug Fuels Frost Botnet Attacks","url":"https://otx.alienvault.com/pulse/69381affff384c7c0e973a8e","created":"2025-12-09"},{"name":"CVE-2025-66516","url":"https://otx.alienvault.com/pulse/6936dfcd5b1ceac8822096da","created":"2025-12-08"},{"name":"JPCERT Confirms Active Command Injection Attacks on Array AG Gateways","url":"https://otx.alienvault.com/pulse/6936a78aaf297fb3fa43630b","created":"2025-12-08"},{"name":"MuddyWater Deploys UDPGangster Backdoor in Targeted Turkey-Israel-Azerbaijan Campaign","url":"https://otx.alienvault.com/pulse/6936a3f4b9092202056313e0","created":"2025-12-08"},{"name":"Sneeit WordPress RCE Exploited in the Wild While ICTBroadcast Bug Fuels Frost Botnet Attacks","url":"https://otx.alienvault.com/pulse/6936a3506299089730f8c4d2","created":"2025-12-08"}],"provenance":"machine"},"cwes":[{"id":"CWE-611","name":"Improper Restriction of XML External Entity Reference"}],"references":[{"url":"https://lists.apache.org/thread/s5x3k93nhbkqzztp1olxotoyjpdlps9k","tags":["vendor-advisory"]},{"url":"https://cve.org/CVERecord?id=CVE-2025-54988","tags":["related"]}],"techniques":[],"reports":[],"affected":[{"ecosystem":"Maven","package":"org.apache.tika:tika-core","vulnerableRanges":[">=1.13, <3.2.2"],"patched":["3.2.2"],"from":["GHSA-f58c-gq56-vjjf"],"provenance":"source"},{"ecosystem":"Maven","package":"org.apache.tika:tika-parsers","vulnerableRanges":[">=1.13, <2.0.0"],"patched":["2.0.0"],"from":["GHSA-f58c-gq56-vjjf"],"provenance":"source"},{"ecosystem":"Maven","package":"org.apache.tika:tika-parser-pdf-module","vulnerableRanges":[">=2.0.0, <3.2.2"],"patched":["3.2.2"],"from":["GHSA-f58c-gq56-vjjf"],"provenance":"source"}],"advisories":[{"id":"GHSA-f58c-gq56-vjjf","url":"https://github.com/advisories/GHSA-f58c-gq56-vjjf","severity":"CRITICAL","ecosystem":"Maven","package":"org.apache.tika:tika-core","vulnerableRanges":[">=1.13, <3.2.2"],"patched":["3.2.2"],"provenance":"source","from":"GHSA"},{"id":"GHSA-f58c-gq56-vjjf","url":"https://github.com/advisories/GHSA-f58c-gq56-vjjf","severity":"CRITICAL","ecosystem":"Maven","package":"org.apache.tika:tika-parsers","vulnerableRanges":[">=1.13, <2.0.0"],"patched":["2.0.0"],"provenance":"source","from":"GHSA"},{"id":"GHSA-f58c-gq56-vjjf","url":"https://github.com/advisories/GHSA-f58c-gq56-vjjf","severity":"CRITICAL","ecosystem":"Maven","package":"org.apache.tika:tika-parser-pdf-module","vulnerableRanges":[">=2.0.0, <3.2.2"],"patched":["3.2.2"],"provenance":"source","from":"GHSA"}],"euvd":{"id":"EUVD-2025-201189","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-201189","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":2,"skipped":1,"earliest":"2025-12-12","earliestUrl":"https://github.com/chasingimpact/CVE-2025-66516-Writeup-POC","repos":[{"name":"chasingimpact/CVE-2025-66516-Writeup-POC","url":"https://github.com/chasingimpact/CVE-2025-66516-Writeup-POC","stars":11,"created":"2025-12-12"},{"name":"sid6224/CVE-2025-66516-POC","url":"https://github.com/sid6224/CVE-2025-66516-POC","stars":6,"created":"2025-12-17"}]},"metasploit":[{"name":"Elasticsearch ingest-attachment Apache Tika XFA XXE Local File Read","module":"auxiliary/scanner/http/elasticsearch_tika_xfa_xxe","type":"auxiliary","disclosureDate":"2025-08-20","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/http/elasticsearch_tika_xfa_xxe.rb"}],"nuclei":[{"id":"CVE-2025-66516","name":"Apache Tika - XML External Entity Injection","severity":"high","path":"http/cves/2025/CVE-2025-66516.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-66516.yaml"}],"first":{"date":"2025-08-20","source":"Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/http/elasticsearch_tika_xfa_xxe.rb"},"provenance":"source"},"exploitRefs":[],"flow":[],"timeline":[{"date":"2025-08-20","kind":"exploit-public","label":"First public exploit: Metasploit; later: PoC-in-GitHub 2025-12-12","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/http/elasticsearch_tika_xfa_xxe.rb","provenance":"source"},{"date":"2025-12-04","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2025-66516","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":"Metasploit","daysToKev":null},"priority":{"score":32.8,"factors":[{"name":"In a KEV catalog","points":0.0,"detail":"not listed"},{"name":"Recent KEV listing","points":0.0,"detail":"not listed"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.96,"detail":"percentile 0.9978"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"2 PoC-in-GitHub repos; 1 Metasploit module; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":1.92,"detail":"6 pulses"},{"name":"CVSS severity","points":5.88,"detail":"base score 8.4"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]},"lineage":{"familyId":"fam-apache-tika-pdf-parser-module-cve-2025-54988","parents":[{"from":"CVE-2025-54988","to":"CVE-2025-66516","relation":"successor","confidence":"high","kind":"lineage","evidence":[{"kind":"text","provenance":"source","relation":"related","quote":"This CVE covers the same vulnerability as in CVE-2025-54988.","from":"CVE.org","in":"CVE-2025-66516"},{"kind":"osv-related","provenance":"source","id":"GHSA-f58c-gq56-vjjf","via":"reference","url":"https://cve.org/CVERecord?id=CVE-2025-54988"},{"kind":"version-step","provenance":"source","package":"Maven:org.apache.tika:tika-parsers","fromFixed":"2.0.0-ALPHA","toFixed":"2.0.0","daysApart":106},{"kind":"similar","provenance":"machine","score":0.72,"basis":"same package + description similarity"}]}],"packageHistory":[{"cve":"CVE-2018-17197","published":"2018-12-24","fixed":"1.20","kev":false},{"cve":"CVE-2019-10093","published":"2019-08-02","fixed":"1.22","kev":false},{"cve":"CVE-2025-54988","published":"2025-08-20","fixed":"2.0.0-ALPHA","kev":false},{"cve":"CVE-2025-66516","published":"2025-12-04","fixed":"2.0.0","kev":false}],"package":"Maven:org.apache.tika:tika-parsers"}}