Skip to content
brandefense.io
Request A Demo
Vulnerability Intelligence

CVE-2025-66516

CriticalPublic exploit

Apache Tika has XXE vulnerability

Published Dec 4, 2025 · Updated Aug 12, 2026 · Also known as DEBIAN-CVE-2025-66516, GHSA-f58c-gq56-vjjf, ROOT-APP-MAVEN-CVE-2025-66516, UBUNTU-CVE-2025-66516

Key Facts

Patch immediately
  • CVE-2025-66516 is a critical-severity vulnerability (CVSS 10.0 v4) affecting Tika (Apache), apache-tika-3.0 (minimos), apache-tika-3.1 (minimos) and 14 more products.
  • It is not listed in any known-exploited vulnerabilities catalog. Public exploit code is available.
  • EPSS estimates a 89% probability of exploitation in the next 30 days.
  • Fixed versions are available, including Tika 3.2.2, Tika 1.22-1ubuntu0.1~esm2, Tika 1.22-2+deb11u1.
  • Brandefense priority: patch immediately, because it is very likely to be exploited soon.

CVSS v4

10.0

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

EPSS (30-day exploit likelihood)

89%

Higher than 99.7% of all scored CVEs

Exploited in the wild

No known

Not in a known-exploited catalog

Public exploit code

Available

Proof-of-concept or weaponized module

Get the full CVE-2025-66516 brief as a PDF

Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.

Description

Critical XXE in Apache Tika tika-core (1.13-3.2.1), tika-pdf-module (2.0.0-3.2.1) and tika-parsers (1.13-1.28.5) modules on all platforms allows an attacker to carry out XML External Entity injection via a crafted XFA file inside of a PDF.

This CVE covers the same vulnerability as in CVE-2025-54988. However, this CVE expands the scope of affected packages in two ways.

First, while the entrypoint for the vulnerability was the tika-parser-pdf-module as reported in CVE-2025-54988, the vulnerability and its fix were in tika-core. Users who upgraded the tika-parser-pdf-module but did not upgrade tika-core to >= 3.2.2 would still be vulnerable.

Second, the original report failed to mention that in the 1.x Tika releases, the PDFParser was in the "org.apache.tika:tika-parsers" module.

Affected Products

34 affected entries in total
ProductAffected versionsFixed in
TikaApacheSee advisory3.2.2
apache-tika-3.0minimosSee advisory3.0.0-r5
apache-tika-3.1minimosSee advisory3.1.0-r5
elasticsearch-8minimosSee advisory8.19.3-r0
elasticsearch-9.1minimosSee advisory9.1.4-r0
12 more affected products in the full CVE brief

Patched Releases

Tika

3.2.2, 1.22-1ubuntu0.1~esm2, 1.22-2+deb11u1, 1.22-2+deb11u1build0.22.04.1

apache-tika-3.0

3.0.0-r5

apache-tika-3.1

3.1.0-r5

devspaces/openvsx-rhel9:3.25.0

1765276570

devspaces/pluginregistry-rhel9:3.25.0

1765299828

elasticsearch-8

8.19.3-r0

elasticsearch-9.1

9.1.4-r0

io.root.org.apache.tika:tika-core

2.9.2-root.io.4, 2.9.2-root.io.5, 2.9.2-root.io.6, 2.9.3-root.io.1

io.root.org.apache.tika:tika-parser-pdf-module

2.9.2-root.io.1, 2.9.2-root.io.2, 2.9.2-root.io.4, 2.9.2-root.io.5, 2.9.2-root.io.6, 2.9.3-root.io.1

libtika-java

1.22-1ubuntu0.1~esm2, 1.22-2+deb11u1build0.22.04.1

opensearch-2

2.19.4-r0

opensearch-3

3.3.0-r0

org.apache.tika:tika-core

3.2.2

org.apache.tika:tika-parser-pdf-module

3.2.2

org.apache.tika:tika-parsers

1.28.5+sp2p2, 2.0.0

seal.sp1p1.org.apache.tika:tika-parsers

1.28.5+sp999

Timeline

  1. Publicly disclosed

    Dec 4, 2025

  2. Last updated

    Aug 12, 2026

Weakness Type

  • CWE-611 Improper Restriction of XML External Entity Reference

References

8 more references in the full CVE brief

FAQ

Common Questions.

Is CVE-2025-66516 Running On Your Attack Surface?

Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.

Request A Demo