Loading story…
Apache disclosed CVE-2026-66756, an Improper Protection of Alternate Path vulnerability in the tika-server component of Apache Tika. The flaw affects org.apache.tika:tika-server versions from 4.0.0-alpha-1 up to, but not including, 4.0.0-beta-1, and involves the unpack endpoint permitting configuration in a way that bypasses the intended unsecureFeatures=false protection.
The project said the issue is fixed in Apache Tika 4.0.0-beta-1 and urged users running affected pre-release versions to upgrade. Apache credited George Chen with discovering the vulnerability and proposing fixes, and published the advisory through the oss-sec mailing list alongside the project’s main site.
See affected versions and whether adversaries are exploiting it.
1 event from the most recent confirmed update back to the earliest known activity.
Apache disclosed CVE-2026-66756 affecting the tika-server unpack endpoint in versions from 4.0.0-alpha-1 up to, but not including, 4.0.0-beta-1, and advised users to upgrade to 4.0.0-beta-1 where the issue is fixed. George Chen was credited with discovering the vulnerability and proposing fixes.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Apache Tika developers released fixes for a **critical XML External Entity (XXE) vulnerability**, tracked as `CVE-2025-66516`, that can be triggered by a specially crafted XFA file embedded in a PDF. The flaw affects **Apache Tika core** versions `1.13` through `3.2.1`, **Apache Tika parsers** versions `1.13` through `1.28.5`, and the **Apache Tika PDF parser module** versions `2.0.0` through `3.2.1`. The issue is rated **CVSS v4 10.0** and could allow attackers to read sensitive files, reach internal network resources, and in worst-case scenarios potentially achieve remote code execution during document processing. Apache’s advisory says `CVE-2025-66516` expands the scope of the earlier `CVE-2025-54988`, broadening the list of affected artifacts beyond the initial record. Organizations using Tika for content extraction or PDF analysis were urged to upgrade **`tika-core`** and **`tika-parser-pdf-module`** to version `3.2.2`, and **`tika-parsers`** to version `2.0.0`, as the vulnerable parsing path can be reached through malicious PDF content supplied to downstream applications and services.
Jul 24, 2026
A critical XML External Entity (XXE) vulnerability, tracked as CVE-2025-66516, has been identified in multiple modules of Apache Tika, including tika-core (versions 1.13–3.2.1), tika-parsers (1.13–1.28.5), and tika-parser-pdf-module (2.0.0–3.2.1). This flaw allows attackers to exploit PDF files containing crafted XFA content to execute XXE attacks, potentially leading to remote code execution or sensitive data exposure. The vulnerability expands upon a previous advisory (CVE-2025-54988) by clarifying that the root issue lies in the core library, not just the PDF parser module, and by broadening the list of affected artifacts to include additional modules and versions. Security experts emphasize that simply updating the PDF parser module is insufficient; organizations must upgrade the tika-core library to version 3.2.2 or later to fully mitigate the risk. Apache Tika is widely used for document parsing and content extraction across various industries, making this vulnerability particularly impactful. Administrators are advised to review their build configurations (such as Maven or Gradle dependencies) to ensure all vulnerable components are updated, as standard usage of the library is enough to trigger the exploit.
Jun 29, 2026
Apache Tomcat released security updates addressing several vulnerabilities across supported branches, including **CVE-2026-59083**, an incorrect URL decoding flaw in `RewriteValve` that can let attackers bypass security constraints in some configurations, and **CVE-2026-59084**, a documentation-related weakness that left `EncryptInterceptor` deployments without clearly defined secure configuration requirements. Apache said affected versions span Tomcat 11, 10.1, 9.0, and 8.5 releases, with some unsupported end-of-life versions potentially exposed as well. Separate Tomcat advisories also described additional patched issues, including **CVE-2026-53434**, an invalid CRL configuration vulnerability rated **CVSS 9.1**, **CVE-2026-50229**, a cross-site scripting flaw in the Number Guess example, and other fixes tracked as **CVE-2026-53404**, **CVE-2026-55276**, **CVE-2026-55955**, and **CVE-2026-55956**. Organizations were urged to test and deploy updated releases, with Apache recommending upgrades to **11.0.24**, **10.1.57**, and **9.0.120** to remediate the newly disclosed issues.
Aug 28, 2026