The vulnerabilities of the tika-core, tika-pdf-module, and tika-parsers modules in the Apache Tika content discovery and analysis framework allow a hacker to execute arbitrary code.

🗓️ 15 Dec 2025 00:00:00Reported by FSTEC of Russia — Information Security Threat DatabaseType

Apache Tika core, pdf module, and parsers have an XML external links flaw enabling arbitrary code via crafted XML forms templates.

Reporter	Title	Published	Views	Family All 94
IBM Security Bulletins	Security Bulletin: IBM SPSS Analytic Server is affected by Critical XXE vulnerability in Apache Tika (CVE-2025-66516)	16 Feb 202612:33	–	ibm
IBM Security Bulletins	Security Bulletin: Due to use of Apache Tika, IBM Operations Analytics - Log Analysis is affected by XML External Entity (XXE) vulnerability	7 Apr 202617:07	–	ibm
IBM Security Bulletins	Security Bulletin: Critical vulnerability addressed in Cloudera Base on premises 7.1.9 SP1 CHF 14 and Cloudera Runtime 7.3.1.700 SP3 CHF 2	2 Mar 202614:36	–	ibm
IBM Security Bulletins	Security Bulletin: IBM InfoSphere Information Server is affected by multiple vulnerabilities in Apache Tika	3 Apr 202616:00	–	ibm
IBM Security Bulletins	Security Bulletin: IBM SPSS Modeler is affected by multiple vulnerabilities in Apache Tika Core and Parsers (CVE-2025-54988, CVE-2025-66516, CVE-2025-66516)	17 Apr 202605:25	–	ibm
IBM Security Bulletins	Security Bulletin: Critical XXE Vulnerability in Apache Tika Affecting Content Collector for Email, File Systems, and Microsoft SharePoint (CVE-2025-66516)	22 Jun 202616:13	–	ibm
IBM Security Bulletins	Security Bulletin: Due to the use of Apache Tika, IBM webMethods Integration Server is vulnerable to XML External Entity injection (CVE-2025-66516)	10 Feb 202610:54	–	ibm
IBM Security Bulletins	Security Bulletin: IBM i Access Client Solutions is vulnerable to an attacker carrying out an XML External Entity injection via a crafted XFA file inside of a PDF (CVE-2025-66516)	14 Jan 202601:43	–	ibm
GithubExploit	Exploit for CVE-2025-66516	8 Dec 202510:50	–	githubexploit
GithubExploit	Exploit for CVE-2025-66516	7 Dec 202503:16	–	githubexploit

Vulners

Node

apache tika_coreRange1.13–3.2.1

apache tika_parsersRange1.13–2.0.0

apache tika_pdfRange2.0.0–3.2.1

Source	Link
github	www.github.com/Ashwesker/Blackash-CVE-2025-66516
lists	www.lists.apache.org/thread/s5x3k93nhbkqzztp1olxotoyjpdlps9k
gitflic	www.gitflic.ru/project/gitflic/gitflic/release
lk	www.lk.astralinux.ru/
web	www.web.nvd.nist.gov/view/vuln/detail

25 Mar 2026 00:00Current

7.8High risk

Vulners AI Score7.8

CVSS 210

CVSS 310

EPSS0.79807