Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2025-66516— Apache Tika core, Apache Tika parsers, Apache Tika PDF parser module: Update to CVE-2025-54988 to expand scope of artifacts affected

Quick assessment

Affected
Apache Software Foundation Apache Tika core
Exploitation
Public or AI PoC available; prioritize validation
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Apache Tika是美国阿帕奇（Apache）基金会的一个集成了POI（使用Java程序对MicrosoftOffice格式文档提供读和写功能的开源函数库）、Pdfbox（读取和创建PDF文档的纯Java类库）并为文本抽取工作提供了统一界面的内容抽取工具集合。 Apache Tika tika-core 1.13版本至3.2.1版本、tika-pdf-module 2.0.0版本至3.2.1版本和tika-parsers 1.13版本至1.28.5版本存在代码问题漏洞，该漏洞源于特制PDF文件中的XF

CVSS 8.4 · High EPSS 78.79% · P100

Public Exploits 1

Nuclei · 1 CVE-2025-66516.yaml [template]

Possible ATT&CK Techniques 1 AI

T1189 · Drive-by Compromise
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2025-66516

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Apache Tika core, Apache Tika parsers, Apache Tika PDF parser module: Update to CVE-2025-54988 to expand scope of artifacts affected
Source: CVE Program / CVE List V5
Vulnerability Description
Critical XXE in Apache Tika tika-core (1.13-3.2.1), tika-pdf-module (2.0.0-3.2.1) and tika-parsers (1.13-1.28.5) modules on all platforms allows an attacker to carry out XML External Entity injection via a crafted XFA file inside of a PDF. This CVE covers the same vulnerability as in CVE-2025-54988. However, this CVE expands the scope of affected packages in two ways. First, while the entrypoint for the vulnerability was the tika-parser-pdf-module as reported in CVE-2025-54988, the vulnerability and its fix were in tika-core. Users who upgraded the tika-parser-pdf-module but did not upgrade tika-core to >= 3.2.2 would still be vulnerable. Second, the original report failed to mention that in the 1.x Tika releases, the PDFParser was in the "org.apache.tika:tika-parsers" module.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
XML外部实体引用的不恰当限制(XXE)
Source: CVE Program / CVE List V5
Vulnerability Title
Apache Tika 代码问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Apache Tika是美国阿帕奇（Apache）基金会的一个集成了POI（使用Java程序对MicrosoftOffice格式文档提供读和写功能的开源函数库）、Pdfbox（读取和创建PDF文档的纯Java类库）并为文本抽取工作提供了统一界面的内容抽取工具集合。 Apache Tika tika-core 1.13版本至3.2.1版本、tika-pdf-module 2.0.0版本至3.2.1版本和tika-parsers 1.13版本至1.28.5版本存在代码问题漏洞，该漏洞源于特制PDF文件中的XF
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Apache Software Foundation Apache Tika core 1.13 ~ 3.2.1 -
Apache Software Foundation Apache Tika parsers 1.13 ~ 2.0.0 -
Apache Software Foundation Apache Tika PDF parser module 2.0.0 ~ 3.2.1 -

II. Public POCs for CVE-2025-66516

# POC Description Source Link Shenlong Link
1 None https://github.com/B1gh0rnn/CVE-2025-66516 POC Details
2 CVE-2025-66516 https://github.com/Ashwesker/Blackash-CVE-2025-66516 POC Details
3 CVE-2025-66516 working exploit, scanner, explanation. https://github.com/chasingimpact/CVE-2025-66516-Writeup-POC POC Details
4 A POC for the CVE-2025-66516 Apache Tika Vulnerability for educational purposes only https://github.com/sid6224/CVE-2025-66516-POC POC Details
5 None https://github.com/intSheep/Tika-CVE-2025-66516-Lab POC Details
6 CVE-2025-66516 https://github.com/Ashwesker/Ashwesker-CVE-2025-66516 POC Details
7 Apache Tika tika-core (1.13-3.2.1), tika-pdf-module (2.0.0-3.2.1), and tika-parsers (1.13-1.28.5) contain an XML External Entity injection caused by processing crafted XFA files inside PDFs, letting attackers perform XXE attacks remotely, exploit requires crafted PDF input. https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-66516.yaml POC Details
8 CVE-2025-66516 https://github.com/yunatamos/Blackash-CVE-2025-66516 POC Details
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2025-66516

请登录查看更多情报信息。

Vendor Advisories for CVE-2025-66516 (1)

Mailing List Discussions for CVE-2025-66516 (1)

IV. Related Vulnerabilities

Same vendor: Apache Software Foundation
Same weakness: CWE-611

V. Comments for CVE-2025-66516

Anonymous User
2026-01-15 06:09:49

Zaproxy alias impedit expedita quisquam pariatur exercitationem. Nemo rerum eveniet dolores rem quia dignissimos.

Leave a comment