Public exploit available
Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2025-66516

Severity
9.8CRITICAL
EPSS
1.5%
top 19.17%
CISA KEV
Not in KEV
Exploit
PoC available
Public exploit / PoC exists
Timeline
PublishedDec 4
Latest updateJan 15

Description

Critical XXE in Apache Tika tika-core (1.13-3.2.1), tika-pdf-module (2.0.0-3.2.1) and tika-parsers (1.13-1.28.5) modules on all platforms allows an attacker to carry out XML External Entity injection via a crafted XFA file inside of a PDF. This CVE covers the same vulnerability as in CVE-2025-54988. However, this CVE expands the scope of affected packages in two ways. First, while the entrypoint for the vulnerability was the tika-parser-pdf-module as reported in CVE-2025-54988, the vulnerabili

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 2.5 | Impact: 5.9

Affected Packages8 packages

🔴Vulnerability Details

4
GHSA
Apache Tika has XXE vulnerability2025-12-04
OSV
Apache Tika has XXE vulnerability2025-12-04
OSV
CVE-2025-66516: Critical XXE in Apache Tika tika-core (12025-12-04
CVEList
Apache Tika core, Apache Tika parsers, Apache Tika PDF parser module: Update to CVE-2025-54988 to expand scope of artifacts affected2025-12-04

💥Exploits & PoCs

1
Nuclei
Apache Tika - XML External Entity Injection

🔍Detection Rules

1
Suricata
ET WEB_SPECIFIC_APPS Apache Tika XML External Entity Injection (CVE-2025-66516)2025-12-15

📋Vendor Advisories

3
Oracle
Oracle Oracle Commerce Risk Matrix: Workbench (Apache Tika) — CVE-2025-665162026-01-15
Red Hat
tika-core: tika-parsers: tika-parser-pdf-module: Apache Tika core, Apache Tika parsers, Apache Tika PDF parser module: Update to CVE-2025-54988 to expand scope of artifacts affected2025-12-04
Debian
CVE-2025-66516: tika - Critical XXE in Apache Tika tika-core (1.13-3.2.1), tika-pdf-module (2.0.0-3.2.1...2025
CVE-2025-66516 (CRITICAL CVSS 9.8) | Critical XXE in Apache Tika tika-co | cvebase.io