Critical XXE Bug CVE-2025-66516 (CVSS 10.0) Hits Apache Tika, Requires Urgent Patch
Summary: Apache Tika carries a maximum-severity XXE flaw, CVE-2025-66516, rated 10.0 on the CVSS scale, affecting tika-core (1.13-3.2.1), tika-pdf-module (2.0.0-3.2.1) and tika-parsers (1.13-1.28.5), where a crafted XFA file inside a PDF lets an attacker trigger XML External Entity injection. The Apache Tika team said the flaw matches CVE-2025-54988 (CVSS 8.4), patched in August 2025, but expands the affected scope because the vulnerable code and its fix were in tika-core, so users who upgraded only tika-parser-pdf-module without moving tika-core to 3.2.2 or later remain exposed, and Atlassian released Bamboo Data Center and Server updates for it on December 11, 2025.
Bottom line: A 10.0 XXE can reach files on the application server and in some cases remote code execution, and the patch history shows the trap: teams that fixed the PDF module in August but left tika-core below 3.2.2 are still vulnerable today.