XML external entity compromise possible with maximum severity Apache Tika bug

Open source content analysis toolkit Apache Tika had its core, PDF, and parser modules impacted with a maximum severity vulnerability, tracked as CVE-2025-66516, which could be leveraged in XML external entity attacks, Security Affairs reports.

Malicious XFA files within a PDF could be leveraged to exploit the flaw which affects Apache Tika core versions 1.13 to 3.2.1, Tika PDF parser module versions 2.0.0 to 3.2.1, and Tika parsers versions 1.13 to 1.28.5 to access sensitive internal resources, an alert from Apache warned.

"...[W]hile the entrypoint for the vulnerability was the tika-parser-pdf-module as reported in CVE-2025-54988, the vulnerability and its fix were in tika-core. Users who upgraded the tika-parser-pdf-module but did not upgrade tika-core to >= 3.2.2 would still be vulnerable," said the advisory. Immediate patching of the flaw has been recommended.