Read the docs
TI-2025-40938 Aliases CVE-2025-66516GHSA-f58c-gq56-vjjf

XML external entity injection in Apache Tika core

Priority CRITICAL 85CWE-611Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat.

Summary

Critical XXE in Apache Tika tika-core (1.13-3.2.1), tika-pdf-module (2.0.0-3.2.1) and tika-parsers (1.13-1.28.5) modules on all platforms allows an attacker to carry out XML External Entity injection via a crafted XFA file inside of a PDF. This CVE covers the same vulnerability as in CVE-2025-54988. However, this CVE expands the scope of affected packages in two ways. First, while the entrypoint for the vulnerability was the tika-parser-pdf-module as reported in CVE-2025-54988, the vulnerability and its fix were in tika-core. Users who upgraded the tika-parser-pdf-module but did not upgrade tika-core to >= 3.2.2 would still be vulnerable. Second, the original report failed to mention that in the 1.x Tika releases, the PDFParser was in the "org.apache.tika:tika-parsers" module.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.89024 99th percentileScored 2026-11-07
Fix Fixed Apache Tika parsers (Apache Software Foundation): 2.0.0org.apache.tika:tika-core (Maven): 3.2.2+2 more productsRed Hat: 2 advisories

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ApacheApache Tika core1.13 – 3.2.1—No fix listedCNA
ApacheApache Tika parsers1.13 to before 2.0.02.0.0Patch availableCNA
ApacheApache Tika PDF parser module2.0.0 – 3.2.1—No fix listedCNA
—org.apache.tika:tika-core (Maven)1.13 to before 3.2.23.2.2Patch availableGHSA-f58c-gq56-vjjf
—org.apache.tika:tika-parsers (Maven)1.13 to before 2.0.02.0.0Patch availableGHSA-f58c-gq56-vjjf
—org.apache.tika:tika-parser-pdf-module (Maven)2.0.0 to before 3.2.23.2.2Patch availableGHSA-f58c-gq56-vjjf
  • Apache Tika core VendorApache Affected 1.13 – 3.2.1 Fixed in — No fix listed CNA
  • Apache Tika parsers VendorApache Affected 1.13 to before 2.0.0 Fixed in 2.0.0 Patch available CNA
  • Apache Tika PDF parser module VendorApache Affected 2.0.0 – 3.2.1 Fixed in — No fix listed CNA
  • org.apache.tika:tika-core (Maven) Vendor— Affected 1.13 to before 3.2.2 Fixed in 3.2.2 Patch available GHSA-f58c-gq56-vjjf
  • org.apache.tika:tika-parsers (Maven) Vendor— Affected 1.13 to before 2.0.0 Fixed in 2.0.0 Patch available GHSA-f58c-gq56-vjjf
  • org.apache.tika:tika-parser-pdf-module (Maven) Vendor— Affected 2.0.0 to before 3.2.2 Fixed in 3.2.2 Patch available GHSA-f58c-gq56-vjjf

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:apache:tika:*:*:*:*:*:*:*:*1.13 to before 3.2.2VulnerableApache
  • cpe:2.3:a:apache:tika:*:*:*:*:*:*:*:* Versions 1.13 to before 3.2.2 Vulnerable ·Apache

Remediation

  • Fix · CNA Apache Tika parsers (Apache Software Foundation) Fixed in 2.0.0
  • Fix · GHSA-f58c-gq56-vjjf org.apache.tika:tika-core (Maven) Fixed in 3.2.2 Advisory →
  • Fix · GHSA-f58c-gq56-vjjf org.apache.tika:tika-parsers (Maven) Fixed in 2.0.0 Advisory →
  • Fix · GHSA-f58c-gq56-vjjf org.apache.tika:tika-parser-pdf-module (Maven) Fixed in 3.2.2 Advisory →

Red Hat 2 advisories

  • RHSA-2025:23225 Released 2025-12-15 · Red Hat rating Critical
    Red Hat OpenShift Dev Spaces 3.25.0 Release.
    • Red Hat OpenShift Dev Spaces (RHOSDS) 3.25 registry.redhat.io/devspaces/code-rhel9, registry.redhat.io/devspaces/openvsx-rhel9, registry.redhat.io/devspaces/pluginregistry-rhel9 +3
  • RHSA-2025:23143 Released 2025-12-11 · Red Hat rating Critical
    Red Hat Build of Apache Camel 4.14.2 for Spring Boot release.
    • Red Hat build of Apache Camel 4.14.2 for Spring Boot 3.5.8

Vendor assessments

Red Hat

Red Hat rating: Critical. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat OpenShift Dev Spaces (RHOSDS) 3.25Fixed RHSA-2025:23225
Red Hat build of Apache Camel 4.14.2 for Spring Boot 3.5.8Fixed RHSA-2025:23143
Not affected: 6 products
  • Red Hat Fuse 7
  • Red Hat JBoss Enterprise Application Platform 7
  • Red Hat JBoss Enterprise Application Platform 8
  • Red Hat JBoss Enterprise Application Platform Expansion Pack
  • Red Hat OpenShift Dev Spaces (RHOSDS) 3.25
  • Red Hat build of Apache Camel for Spring Boot 4

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-66516
  2. 2026-10-03 Alias added: GHSA-f58c-gq56-vjjf

References

Advisory 3

Other 1

  • TI-2018-01236 From Apache Tika versions 1.7 to 1.17, clients could send carefully crafted headers to… CVSS 3.0HIGH 8.1
  • TI-2025-34694 Apache Tika PDF parser module: XXE vulnerability in PDFParser's handling of XFA CVSS 3.1CRITICAL 9.8
  • TI-2016-05850 Apache Tika before 1.14 allows Java code execution for serialized objects embedded in… CVSS 3.1CRITICAL 9.8
  • TI-2021-13169 An XXE issue in SAXBuilder in JDOM through 2.0.6 allows attackers to cause a denial of… CVSS 3.1HIGH 7.5
  • TI-2019-07413 Resource allocation without limits in Apache Tika CVSS 3.0HIGH 8.8
  • TI-2018-08418 XML external entity injection in Apache Tika CVSS 3.0HIGH 7.5
See all 26 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences