CVE-2025-66516 PoC — Apache Tika 代码问题漏洞

Source

https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-66516.yaml

Associated Vulnerability

Title:Apache Tika 代码问题漏洞 (CVE-2025-66516)
Description:Apache Tika是美国阿帕奇（Apache）基金会的一个集成了POI（使用Java程序对MicrosoftOffice格式文档提供读和写功能的开源函数库）、Pdfbox（读取和创建PDF文档的纯Java类库）并为文本抽取工作提供了统一界面的内容抽取工具集合。 Apache Tika tika-core 1.13版本至3.2.1版本、tika-pdf-module 2.0.0版本至3.2.1版本和tika-parsers 1.13版本至1.28.5版本存在代码问题漏洞，该漏洞源于特制PDF文件中的XF

Description

Apache Tika tika-core (1.13-3.2.1), tika-pdf-module (2.0.0-3.2.1), and tika-parsers (1.13-1.28.5) contain an XML External Entity injection caused by processing crafted XFA files inside PDFs, letting attackers perform XXE attacks remotely, exploit requires crafted PDF input.

File Snapshot


 id: CVE-2025-66516

info:
  name: Apache Tika - XML External Entity Injection
  author: Mathematicia

...

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.

Goal Reached Thanks to every supporter — we hit 100%!