Raw vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HSummary
CVE-2025-66516 is a high-severity Improper Restriction of XML External Entity Reference (CWE-611) vulnerability in Apache Tika. Its CVSS base score is 8.4 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 0.4% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to CM-6 (Configuration Settings) and SA-11 (Developer Testing and Evaluation) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2025-66516 is a critical XML External Entity (XXE) vulnerability, classified under CWE-611, affecting Apache Tika's tika-core module versions 1.13 through 3.2.1, tika-pdf-module versions 2.0.0 through 3.2.1, and tika-parsers module versions 1.13 through 1.28.5 on all platforms. The flaw enables attackers to conduct XXE injection by processing a crafted XFA file embedded inside a PDF document. This CVE covers the same vulnerability as CVE-2025-54988 but expands the scope in two key ways: the root issue and fix are in tika-core, meaning upgrades to tika-pdf-module alone are insufficient if tika-core remains below 3.2.2; additionally, in Tika 1.x releases, the PDFParser resides in the tika-parsers module.
Exploitation requires local access (AV:L) with low complexity (AC:L), no privileges (PR:N), and no user interaction (UI:N), yielding high impacts on confidentiality, integrity, and availability (CVSSv3.1 score of 8.4). An attacker can leverage the XXE via the crafted PDF to inject external entities when the affected Tika modules parse the file.
The Apache advisory, referenced in the mailing list thread, recommends upgrading tika-core to version 3.2.2 or higher as the primary mitigation, emphasizing that partial upgrades to dependent modules like tika-pdf-module do not resolve the issue. Further details on the original report and expanded scope are available in the CVE-2025-54988 record.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-201189
Vulnerability Data
Critical XXE in Apache Tika tika-core (1.13-3.2.1), tika-pdf-module (2.0.0-3.2.1) and tika-parsers (1.13-1.28.5) modules on all platforms allows an attacker to carry out XML External Entity injection via a crafted XFA file inside of a PDF. This CVE covers the same…
more
vulnerability as in CVE-2025-54988. However, this CVE expands the scope of affected packages in two ways. First, while the entrypoint for the vulnerability was the tika-parser-pdf-module as reported in CVE-2025-54988, the vulnerability and its fix were in tika-core. Users who upgraded the tika-parser-pdf-module but did not upgrade tika-core to >= 3.2.2 would still be vulnerable. Second, the original report failed to mention that in the 1.x Tika releases, the PDFParser was in the "org.apache.tika:tika-parsers" module.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V1.5.1V15.3.2
Mitigating Controls (NIST 800-53 r5) AI
Secure configuration settings can disable external entity processing in XML parsers.
Developer testing can discover XXE flaws through targeted XML parsing tests.
Input validation can reject or sanitize XML containing external entity references.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Hardened XML parser configurations directly disable external entity resolution.
Secure SDLC practices include input validation and safe XML parser configuration that prevent XXE.
Vulnerability scanning can discover XXE flaws but does not prevent their introduction in code.
Patching eliminates XXE-vulnerable parser versions but is only one aspect of software maintenance.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing in development catches XXE via static analysis and dynamic XML fuzzing.
Vulnerability management identifies and patches XML libraries with unsafe default entity settings.
Secure development life cycle mandates input validation and entity handling that directly prevents XXE.
Application security requirements explicitly call for disabling external entity processing in XML parsers.
Secure architecture principles include safe parser configuration that mitigates external entity risks.
Secure coding standards require disabling DTDs and external entities in XML processing.