Vulnerabilitycritical

Critical XXE Bug CVE-2025-66516 (CVSS 10.0) Hits Apache Tika, Requires Urgent Patch

The Hacker Newsby @TheHackersNewsDec 15, 2025 · 00:00 UTC (Dec 15, 2025)2 min read5 · 2 reads

Read at thehackernews.com

Analyze CVE-2025-66516 with Vani AIImpact, affected versions, exploitation, mitigations and detection

CVEs: CVE-2025-66516 CVE-2025-54988

Tags: cve-2025-66516 cve-2025-54988 vulnerability

Vulnerabilities mentioned

All

CVE	Vulnerability	CVSS	EPSS	Signals	Published
CVE-2025-54988	Critical XXE in Apache Tika (tika-parser-pdf-module) in Apache Tika 1.13 through and including 3.2.1 on all platforms allows an attacker to carry out XML…	8.4	15%		Aug 20, 2025
CVE-2025-66516	Critical XXE in Apache Tika PDF parsing via crafted XFA forms	9.8	80%		Dec 4, 2025

From the original article

2 min read at thehackernews.com

 Ravie Lakshmanan  Dec 05, 2025 Application Security / Vulnerability A critical security flaw has been disclosed in Apache Tika that could result in an XML external entity ( XXE ) injection attack. The vulnerability, tracked as CVE-2025-66516 , is rated 10. 0 on the CVSS scoring scale, indicating maximum severity.

The Hacker News

By @TheHackersNews · thehackernews.com

Read the full article at The Hacker News

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.