Patchfirst
Patchfirst
CVE-2025-66516 Public exploit High · 8.4 EPSS 89.0%

Apache Tika core, Apache Tika parsers, Apache Tika PDF parser module: Update to CVE-2025-54988 to expand scope of…

Apache Software Foundation · Apache Tika core

Official description · CVE.org

Critical XXE in Apache Tika tika-core (1.13-3.2.1), tika-pdf-module (2.0.0-3.2.1) and tika-parsers (1.13-1.28.5) modules on all platforms allows an attacker to carry out XML External Entity injection via a crafted XFA file inside of a PDF. This CVE covers the same vulnerability as in CVE-2025-54988. However, this CVE expands the scope of affected packages in two ways. First, while the entrypoint for the vulnerability was the tika-parser-pdf-module as reported in CVE-2025-54988, the vulnerability and its fix were in tika-core. Users who upgraded the tika-parser-pdf-module but did not upgrade tika-core to >= 3.2.2 would still be vulnerable. Second, the original report failed to mention that in the 1.x Tika releases, the PDFParser was in the "org.apache.tika:tika-parsers" module.

Breakdown
32.8 / 100
Exploited
Not confirmed
Reports
0
Tactics
0/15

Public exploit code (Metasploit) was available 3 months before disclosure.

  1. Public exploit codeMetasploit3 mo before
  2. Disclosedday 0

2 related vulnerabilities in the same code over 3 months. The latest fix listed for tika-parsers is 2.0.0.

Linked vulnerabilitiesLinked by evidence that a fix failed or the same code was patched again. Oldest first.

  1. CVE-2025-54988Tika PDF parser module: XXE vulnerability in PDFParser's…20 Aug 2025
  2. relatedHigh

    Why these are linked:

    • Stated in the CVE textThis CVE covers the same vulnerability as in CVE-2025-54988.
    • Linked in OSV/GitHub advisoryGHSA-f58c-gq56-vjjf
    • Fixed one release later2.0.0-ALPHA → 2.0.0 (org.apache.tika:tika-parsers)
    • Similar weakness in the same product (machine-matched)same package + description similarity
    This CVECVE-2025-66516Tika core, Apache Tika parsers, Apache Tika PDF parser module…4 Dec 2025

Fixes in tika-parsersMaven package, by fixed version. Earlier and later fixes in the same package, not necessarily the same bug.

  1. 1.20CVE-2018-1719724 Dec 2018
  2. 1.22CVE-2019-100932 Aug 2019
  3. 2.0.0-ALPHACVE-2025-5498820 Aug 2025
  4. 2.0.0CVE-2025-665164 Dec 2025Latest listed

techniques

No techniques linked

No ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.

Am I affected? What do I upgrade to?

From GitHub Security Advisories and OSV

3 packages in 1 ecosystem. No single main package: each of these ships the affected code.

  • Mavenorg.apache.tika:tika-core
    Affected: 1.13 up to 3.2.2Upgrade to 3.2.2 or later
    GHSA-f58c-gq56-vjjf
  • Mavenorg.apache.tika:tika-parsers
    Affected: 1.13 up to 2.0.0Upgrade to 2.0.0 or later
    GHSA-f58c-gq56-vjjf
  • Mavenorg.apache.tika:tika-parser-pdf-module
    Affected: 2.0.0 up to 3.2.2Upgrade to 3.2.2 or later
    GHSA-f58c-gq56-vjjf

Check your lockfile against all CVEs

What security researchers reported

Not named in any threat report yet

Also mentioned in 6 community threat pulses (AlienVault OTX)

Weaker evidence

Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.

References

2 links, grouped by NVD tag

vendor-advisory 1

lists.apache.org/thread/s5x3k93nhbkqzztp1olxotoyjpdlps9k

related 1

cve.org/CVERecord?id=CVE-2025-54988
↑ ↓ chooseEnter openEsc close