Maximum-severity XXE vulnerability discovered in Apache Tika
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2025-54988 | Critical XXE in Apache Tika (tika-parser-pdf-module) in Apache Tika 1.13 through and including 3.2.1 on all platforms allows an attacker to carry out XML Extern Critical XXE in Apache Tika (tika-parser-pdf-module) in Apache Tika 1.13 through and including 3.2.1 on all platforms allows an attacker to carry out XML External Entity injection via a crafted XFA file inside of a PDF. An attacker may be able to read sensitive data or trigger malicious requests to internal resources or third-party servers. Note that the tika-parser-pdf-module is used as a dependency in several Tika packages including at least: tika-parsers-standard-modules, tika-parsers-standard-package, tika-app, tika-grpc and tika-server-standard. Users are recommended to upgrade to version 3.2.2, which fixes this issue. NVD description · AI analysis pending | 8.4 | 15% |
| — | ||
| CVE-2025-66516 | Critical XXE in Apache Tika PDF parsing via crafted XFA forms Apache Tika is vulnerable to XML External Entity (XXE) injection (CWE-611), rated critical at CVSS 9.8 (network-exploitable, no privileges or user interaction required), with the vulnerable code residing in tika-core but reachable through the PDF parser when it processes the XFA form embedded in a PDF. An attacker who can get Tika to parse a crafted PDF, typically by submitting a document to a Tika-based service or tika-server endpoint, can have the XML parser resolve external entities, gaining arbitrary local file read and SSRF from the Tika process, with CVSS impact rated high for confidentiality, integrity and availability. All platforms are affected across tika-core 1.13–3.2.1, tika-parser-pdf-module 2.0.0–3.2.1, and the 1.x tika-parsers module 1.13–1.28.5; notably the fix is in tika-core (3.2.2+), so upgrading only the PDF module leaves deployments vulnerable, and 1.x users need fixes in the tika-parsers module. Anyone running affected Tika versions to process untrusted PDFs is exposed, including standalone tika-server instances and downstream applications that embed Tika (vendors such as Atlassian have shipped fixes for embedded Tika). There is no CISA KEV listing and no public PoC or confirmed in-the-wild exploitation known, but EPSS puts it in the 100th percentile with an 80.3% probability of exploitation within 30 days. Do: Upgrade tika-core to 3.2.2 or later (upgrading only tika-parser-pdf-module is insufficient), and keep tika-parser-pdf-module aligned on the fixed 3.x line; users on the 1.x line should upgrade both tika-parsers and tika-core to the patched 1.x releases. If you consume Tika through another product (e.g., Solr-based stacks or Atlassian products), apply that vendor's patch. Until patched, avoid parsing untrusted PDFs with affected Tika versions, and restrict the Tika process's file-system and network access to limit file-read and SSRF impact. | 9.8 | 80% |
| mass≈100k+ exposed systems and plausibly millions of deployments/users (Tika is a ubiquitous Java document-parsing library bundled in Apache Solr, NiFi and… |
Full article499 words · extracted from securityaffairs.com · click to collapse
Pierluigi Paganini
December 06, 2025
A maximum severity vulnerability in Apache Tika, tracked as CVE-2025-66516 (CVSS score of 10.0), allows XML external entity attacks.
CVE-2025-66516 carries a maximum CVSS rating of 10.0 because it lets attackers trigger an XXE injection in Apache Tika’s core, PDF, and parser modules. An attacker can embed a malicious XFA file inside a PDF and trick Tika into processing external XML entities, opening a path to sensitive internal resources.
Apache Tika is an open-source content analysis toolkit used to extract text, metadata, and structured information from virtually any type of file. Tika is widely used in systems like search indexes, document ingestion pipelines (e.g., Apache Solr, Elasticsearch), compliance tools, and content analysis platforms.
“Critical XXE in Apache Tika tika-core (1.13-3.2.1), tika-pdf-module (2.0.0-3.2.1) and tika-parsers (1.13-1.28.5) modules on all platforms allows an attacker to carry out XML External Entity injection via a crafted XFA file inside of a PDF. This CVE covers the same vulnerability as in CVE-2025-54988.” reads the advisory. “However, this CVE expands the scope of affected packages in two ways. First, while the entrypoint for the vulnerability was the tika-parser-pdf-module as reported in CVE-2025-54988, the vulnerability and its fix were in tika-core. Users who upgraded the tika-parser-pdf-module but did not upgrade tika-core to >= 3.2.2 would still be vulnerable. Second, the original report failed to mention that in the 1.x Tika releases, the PDFParser was in the “org.apache.tika:tika-parsers” module.”
XXE injection (XML External Entity injection) is a type of security vulnerability that occurs when an application parses XML input insecurely and allows attackers to load external entities, special XML features that reference files or URLs outside the document.
The vulnerability affects the following versions:
- Apache Tika core (org.apache.tika:tika-core) 1.13 through 3.2.1
- Apache Tika parsers (org.apache.tika:tika-parsers) 1.13 before 2.0.0
- Apache Tika PDF parser module (org.apache.tika:tika-parser-pdf-module) 2.0.0 through 3.2.1
According to the advisory, the new CVE describes the same flaw as CVE-2025-54988 but clarifies that the issue is broader. Although it was initially linked to the PDF parser module, the root vulnerability and its fix are actually in tika-core, meaning anyone who updated only the PDF module without upgrading tika-core to version 3.2.2 or later remains exposed. It also notes that older Tika 1.x releases include PDFParser inside the tika-parsers module, expanding the set of affected packages beyond what the first advisory stated.
“This CVE covers the same vulnerability as in CVE-2025-54988. However, this CVE expands the scope of affected packages in two ways. First, while the entrypoint for the vulnerability was the tika-parser-pdf-module as reported in CVE-2025-54988, the vulnerability and its fix were in tika-core. Users who upgraded the tika-parser-pdf-module but did not upgrade tika-core to >= 3.2.2 would still be vulnerable.” “Second, the original report failed to mention that in the 1.x Tika releases, the PDFParser was in the “org.apache.tika:tika-parsers” module.”
The project maintainers urge users to install the updates as soon as possible.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, XXE injection)
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/185363/security/maximum-severity-xxe-vulnerability-discovered-in-apache-tika.html