Loading story…
Apache Tika developers released fixes for a critical XML External Entity (XXE) vulnerability, tracked as CVE-2025-66516, that can be triggered by a specially crafted XFA file embedded in a PDF. The flaw affects Apache Tika core versions 1.13 through 3.2.1, Apache Tika parsers versions 1.13 through 1.28.5, and the Apache Tika PDF parser module versions 2.0.0 through 3.2.1. The issue is rated CVSS v4 10.0 and could allow attackers to read sensitive files, reach internal network resources, and in worst-case scenarios potentially achieve remote code execution during document processing.
Apache’s advisory says CVE-2025-66516 expands the scope of the earlier CVE-2025-54988, broadening the list of affected artifacts beyond the initial record. Organizations using Tika for content extraction or PDF analysis were urged to upgrade tika-core and tika-parser-pdf-module to version 3.2.2, and tika-parsers to version 2.0.0, as the vulnerable parsing path can be reached through malicious PDF content supplied to downstream applications and services.
See affected versions and whether adversaries are exploiting it.
3 events from the most recent confirmed update back to the earliest known activity.
An XML External Entity vulnerability in Apache Tika was initially tracked as CVE-2025-54988. A later Apache notice stated that a subsequent CVE would expand the scope of affected artifacts beyond this earlier record.
Apache Tika developers released security updates to fix the critical XXE vulnerability CVE-2025-66516, which can be triggered via a crafted XFA file embedded in a PDF. Users were advised to update Tika-core and Tika-parser-pdf-module to 3.2.2 and Tika-parsers to 2.0.0.
Apache updated the earlier CVE-2025-54988 to broaden the affected Apache Tika artifacts and tracked the expanded issue as CVE-2025-66516. The expanded scope covered Tika core, Tika parsers, and the Tika PDF parser module.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
4 references tracked. Mallory keeps watching after this page renders.
csirt.sk
Open sourcecve.org
Open sourcecve.org
Open sourcelists.apache.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A critical XML External Entity (XXE) vulnerability, tracked as CVE-2025-66516, has been identified in multiple modules of Apache Tika, including tika-core (versions 1.13–3.2.1), tika-parsers (1.13–1.28.5), and tika-parser-pdf-module (2.0.0–3.2.1). This flaw allows attackers to exploit PDF files containing crafted XFA content to execute XXE attacks, potentially leading to remote code execution or sensitive data exposure. The vulnerability expands upon a previous advisory (CVE-2025-54988) by clarifying that the root issue lies in the core library, not just the PDF parser module, and by broadening the list of affected artifacts to include additional modules and versions. Security experts emphasize that simply updating the PDF parser module is insufficient; organizations must upgrade the tika-core library to version 3.2.2 or later to fully mitigate the risk. Apache Tika is widely used for document parsing and content extraction across various industries, making this vulnerability particularly impactful. Administrators are advised to review their build configurations (such as Maven or Gradle dependencies) to ensure all vulnerable components are updated, as standard usage of the library is enough to trigger the exploit.
Jun 29, 2026
Apache disclosed **CVE-2026-66756**, an *Improper Protection of Alternate Path* vulnerability in the `tika-server` component of Apache Tika. The flaw affects `org.apache.tika:tika-server` versions from `4.0.0-alpha-1` up to, but not including, `4.0.0-beta-1`, and involves the unpack endpoint permitting configuration in a way that bypasses the intended `unsecureFeatures=false` protection. The project said the issue is fixed in **Apache Tika `4.0.0-beta-1`** and urged users running affected pre-release versions to upgrade. Apache credited **George Chen** with discovering the vulnerability and proposing fixes, and published the advisory through the `oss-sec` mailing list alongside the project’s main site.
Jul 30, 2026
Apache disclosed **CVE-2026-88789**, a high-severity XXE flaw (CVSS 8.6, CWE-611) in the `camel-quarkus-support-xalan` XSLT extension. The extension forces legacy Xalan-J 2.7.x as the default JAXP `TransformerFactory`, which does not honor Camel’s external-DTD and stylesheet access restrictions. An unauthenticated attacker able to provide XML for transformation as a `javax.xml.transform.Source` could use external entities to read local files or induce requests to internal network services. Versions 3.2.0 through 3.33.2 and 3.34.0 through 3.39.x are affected; XML bodies converted to hardened `SAXSource` objects are not on the directly affected path. Camel Quarkus fixed the issue in versions **3.33.3** and **3.40.0** by enforcing parser-level blocks on external general entities, external parameter entities, and external DTDs within its Xalan transformer factory. The fix also denies XSLT `document()` resource retrieval unless an application-provided `URIResolver` explicitly authorizes it, while retaining application and per-exchange resolver behavior. Organizations using affected releases should upgrade promptly and review direct use of `TransformerFactory.newInstance()` and any intentionally configured URI resolvers; XSLT `xsl:import` and `xsl:include` remain outside these specific runtime controls because Xalan resolves them during stylesheet compilation.
Oct 1, 2026