CVE-2025-66516— Apache Tika core, Apache Tika parsers, Apache Tika PDF parser module: Update to CVE-2025-54988 to expand scope of artifacts affected
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2025-66516
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Apache Tika core, Apache Tika parsers, Apache Tika PDF parser module: Update to CVE-2025-54988 to expand scope of artifacts affected
Source: NVD (National Vulnerability Database)
Vulnerability Description
Critical XXE in Apache Tika tika-core (1.13-3.2.1), tika-pdf-module (2.0.0-3.2.1) and tika-parsers (1.13-1.28.5) modules on all platforms allows an attacker to carry out XML External Entity injection via a crafted XFA file inside of a PDF. This CVE covers the same vulnerability as in CVE-2025-54988. However, this CVE expands the scope of affected packages in two ways. First, while the entrypoint for the vulnerability was the tika-parser-pdf-module as reported in CVE-2025-54988, the vulnerability and its fix were in tika-core. Users who upgraded the tika-parser-pdf-module but did not upgrade tika-core to >= 3.2.2 would still be vulnerable. Second, the original report failed to mention that in the 1.x Tika releases, the PDFParser was in the "org.apache.tika:tika-parsers" module.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Source: NVD (National Vulnerability Database)
Vulnerability Type
XML外部实体引用的不恰当限制(XXE)
Source: NVD (National Vulnerability Database)
Vulnerability Title
Apache Tika 代码问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Apache Tika是美国阿帕奇（Apache）基金会的一个集成了POI（使用Java程序对MicrosoftOffice格式文档提供读和写功能的开源函数库）、Pdfbox（读取和创建PDF文档的纯Java类库）并为文本抽取工作提供了统一界面的内容抽取工具集合。 Apache Tika tika-core 1.13版本至3.2.1版本、tika-pdf-module 2.0.0版本至3.2.1版本和tika-parsers 1.13版本至1.28.5版本存在代码问题漏洞，该漏洞源于特制PDF文件中的XF
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Apache Software Foundation | Apache Tika core | 1.13 ~ 3.2.1 | - | |
| Apache Software Foundation | Apache Tika parsers | 1.13 ~ 2.0.0 | - | |
| Apache Software Foundation | Apache Tika PDF parser module | 2.0.0 ~ 3.2.1 | - |
II. Public POCs for CVE-2025-66516
| # | POC Description | Source Link | Shenlong Link |
|---|---|---|---|
| 1 | None | https://github.com/B1gh0rnn/CVE-2025-66516 | POC Details |
| 2 | CVE-2025-66516 | https://github.com/Ashwesker/Blackash-CVE-2025-66516 | POC Details |
| 3 | CVE-2025-66516 working exploit, scanner, explanation. | https://github.com/chasingimpact/CVE-2025-66516-Writeup-POC | POC Details |
| 4 | A POC for the CVE-2025-66516 Apache Tika Vulnerability for educational purposes only | https://github.com/sid6224/CVE-2025-66516-POC | POC Details |
| 5 | None | https://github.com/intSheep/Tika-CVE-2025-66516-Lab | POC Details |
| 6 | CVE-2025-66516 | https://github.com/Ashwesker/Ashwesker-CVE-2025-66516 | POC Details |
| 7 | Apache Tika tika-core (1.13-3.2.1), tika-pdf-module (2.0.0-3.2.1), and tika-parsers (1.13-1.28.5) contain an XML External Entity injection caused by processing crafted XFA files inside PDFs, letting attackers perform XXE attacks remotely, exploit requires crafted PDF input. | https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-66516.yaml | POC Details |
| 8 | CVE-2025-66516 | https://github.com/yunatamos/Blackash-CVE-2025-66516 | POC Details |
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2025-66516
请登录查看更多情报信息。
IV. Related Vulnerabilities
Same vendor: Apache Software Foundation
- CVE-2026-39816
Apache NiFi: Missing Execute Code Required Permission on Tin - CVE-2026-25199
Apache CloudStack: Proxmox Extension Allows Unauthorized Cro - CVE-2026-25077
Apache CloudStack: Unauthenticated Command Injection in Dire - CVE-2025-69233
Apache CloudStack: Domain/account resources limits not honor - CVE-2025-66467
Apache CloudStack: MinIO policy remains intact on bucket del
Same weakness: CWE-611
- CVE-2026-41936
Vvveb < 1.0.8.2 XML External Entity Injection via Import - CVE-2026-40682
Apache OpenNLP: XXE via Dictionary Parsing in DictionaryEntr - CVE-2026-6501
ILM Informatique jOpenDocument 代码问题漏洞 - CVE-2025-14543
Improper Restriction of XML External Entity Reference vulner - CVE-2024-13971
Arbitrary File Read and Server Side Request Forgery via XML
V. Comments for CVE-2025-66516
Anonymous User
2026-01-15 06:09:49Zaproxy alias impedit expedita quisquam pariatur exercitationem. Nemo rerum eveniet dolores rem quia dignissimos.