Critical Apache Tika Core Vulnerability Exploited Through Malicious PDF Uploads

A critical XML External Entity (XXE) injection vulnerability in Apache Tika has been formally catalogued as CVE-2025-66516, significantly expanding the scope of affected systems beyond the initially reported CVE-2025-54988.

The vulnerability permits attackers to execute XXE attacks through specially crafted XFA (XML Forms Architecture) files embedded within PDF documents, potentially leading to information disclosure, denial of service, or unauthorized data access.

The vulnerability affects a broad range of Apache Tika components across multiple versions. Apache Tika core versions 1.13 through 3.2.1 are vulnerable, as are Apache Tika parsers versions 1.13 before 2.0.0.

Additionally, the Apache Tika PDF parser module (tika-parser-pdf-module) covering versions 2.0.0 through 3.2.1 remains exposed.

The vulnerability targets all supported platforms without platform-specific limitations.

The critical distinction between CVE-2025-66516 and its predecessor CVE-2025-54988 lies in its expanded scope documentation.

While CVE-2025-54988 initially identified the tika-parser-pdf-module as the entry point for exploitation, subsequent analysis revealed that the underlying vulnerability and its remediation actually reside within tika-core itself.

This means organizations that selectively upgraded their tika-parser-pdf-module to patched versions while neglecting tika-core updates remained fully vulnerable to exploitation.

CVE ID	Severity	Vulnerability Type	Affected Component
CVE-2025-66516	Critical	XML External Entity (XXE) Injection	Apache Tika Core, Parsers, PDF Module

Furthermore, CVE-2025-66516 corrects a significant oversight in the original vulnerability report. In Apache Tika’s 1.x release series, the PDFParser component was integrated into the “org.apache.tika:tika-parsers” module rather than existing as a separate package.

This omission in CVE-2025-54988 left many legacy Tika implementations unaccounted for in update recommendations and patch deployment strategies.

Mitigation strategy requires organizations to upgrade tika-core to version 3.2.2 or later, regardless of their tika-parser-pdf-module version status.

For users operating Tika 1.x environments, upgrading tika-parsers to version 2.0.0 or newer becomes mandatory.

The XXE vulnerability exploitable through crafted XFA files represents a severe security risk, particularly in environments processing untrusted PDF documents from external sources.

Security teams should prioritize these updates in their vulnerability management workflows and verify complete patching across all Tika components within their infrastructure to eliminate potential exploitation vectors.

Find this Story Interesting! Follow us on Google News, LinkedIn and X to Get More Instant Updates