CVE-2025-66516-POC

⚠️ READ DISCLAIMER BEFORE USE ⚠️ Educational/Authorized Testing Only | License | Security Policy About This POC This repository contains a proof-of-concept POC exploit for CVE-2025-66516 , an XML External Entity XXE injection vulnerability in Apache Tika versions prior to 3.2.2. The vulnerability...

Security Bulletin: Impacted IBM Optim 1.0.0 and 1.1.0  by vulnerabilities in Apache Tika PDF parser module

Summary IBM Optim versions 1.0.0 and 1.1.0 include open-source package Apache Tika that is affected by a critical vulnerability. IBM Optim 1.2.0 resolves this vulnerability by upgrading the affected open-source dependency to a fixed version. Vulnerability Details CVEID:CVE-2025-54988 DESCRIPTION:...

com.norconex.collectors:norconex-collector-core (3.2.0), com.norconex.collectors:norconex-collector-filesystem (3.2.0) +3 more potentially affected by CVE-2026-66755 via org.apache.tika:tika-parser-scientific-module (>=3.0.0-beta, <=3.3.1)

org.apache.tika:tika-parser-scientific-module MAVEN version =3.0.0-beta, =3.0.0-beta, =3.3.1 Source cves: CVE-2026-66755 Source advisory: SNYK:JAVA-ORGAPACHETIKA-19351260...

org.apache.tika:tika-parser-scientific-package (4.0.0-alpha-1) potentially affected by CVE-2026-66755 via org.apache.tika:tika-parser-scientific-module (4.0.0-alpha-1)

org.apache.tika:tika-parser-scientific-module MAVEN version 4.0.0-alpha-1 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tika:tika-parser-scientific-module and may be impacted: - org.apache.tika:tika-parser-scientific-package 4.0.0-alpha-1...

com.norconex.collectors:norconex-collector-core (3.2.0), com.norconex.collectors:norconex-collector-filesystem (3.2.0) +13 more potentially affected by CVE-2026-66755 via org.apache.tika:tika-parser-scientific-module (>=2.1.0, <=3.3.1)

org.apache.tika:tika-parser-scientific-module MAVEN version =2.1.0, =2.8, =2.8, =2.8, =2.8, =2.8, =2.8, =2.8, =2.8, =2.1.0, =3.3.1 Source cves: CVE-2026-66755 Source advisory: MEND:CVE-2026-66755...

ROOT-APP-MAVEN-CVE-2025-54988 CVE-2025-54988 in io.root.org.apache.tika:tika-parser-pdf-module - Patched by Root

Root has patched CVE-2025-54988 in the io.root.org.apache.tika:tika-parser-pdf-module package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2025-66516 CVE-2025-66516 in io.root.org.apache.tika:tika-parser-pdf-module - Patched by Root

Root has patched CVE-2025-66516 in the io.root.org.apache.tika:tika-parser-pdf-module package for Root:Maven. Multiple fixed versions available...

XML External Entity (XXE) Injection

Apache Tika is vulnerable to XML External Entity XXE injection. The vulnerability is due to improper handling of XFA content in PDFs within the tika-parser-pdf-module, where crafted XFA files can trigger XXE, allowing attackers to read sensitive files or make malicious internal or external reques...

ai.driftkit:driftkit-context-engineering-spring-ai-starter (>=0.6.0, <=0.9.2), ai.driftkit:driftkit-context-engineering-spring-boot-starter (>=0.5.0, <=0.9.2) +335 more potentially affected by CVE-2025-66516 via org.apache.tika:tika-parser-pdf-module (>=2.0.0, <=3.2.1)

org.apache.tika:tika-parser-pdf-module MAVEN version =2.0.0, =0.6.0, =0.5.0, =0.7.0, =0.7.0, =0.5.0, =0.8.3, =0.8.3, =0.8.3, =0.5.0, =0.5.0, =1.2.0, =1.0.3.1-jdk21, =1.0.0, =1.0.0, =1.0, =1.4 and more Source cves: CVE-2025-66516 Source advisory: GHSA-F58C-GQ56-VJJF...

UBUNTU-CVE-2025-66516

Critical XXE in Apache Tika tika-core 1.13-3.2.1, tika-pdf-module 2.0.0-3.2.1 and tika-parsers 1.13-1.28.5 modules on all platforms allows an attacker to carry out XML External Entity injection via a crafted XFA file inside of a PDF. This CVE covers the same vulnerability as in CVE-2025-54988...

EUVD-2025-201189

Critical XXE in Apache Tika tika-core 1.13-3.2.1, tika-pdf-module 2.0.0-3.2.1 and tika-parsers 1.13-1.28.5 modules on all platforms allows an attacker to carry out XML External Entity injection via a crafted XFA file inside of a PDF. This CVE covers the same vulnerability as in CVE-2025-54988...

ai.driftkit:driftkit-context-engineering-spring-ai-starter (>=0.6.0, <=0.9.2), ai.driftkit:driftkit-context-engineering-spring-boot-starter (>=0.5.0, <=0.9.2) +335 more potentially affected by CVE-2025-66516 via org.apache.tika:tika-parser-pdf-module (>=2.0.0, <=3.2.1)

org.apache.tika:tika-parser-pdf-module MAVEN version =2.0.0, =0.6.0, =0.5.0, =0.7.0, =0.7.0, =0.5.0, =0.8.3, =0.8.3, =0.8.3, =0.5.0, =0.5.0, =1.2.0, =1.0.3.1-jdk21, =1.0.0, =1.0.0, =1.0, =1.4 and more Source cves: CVE-2025-66516 Source advisory: MEND:CVE-2025-66516...

CVE-2025-54988

An XML External Entity injection flaw was found in the Apache Tika tika-parser-pdf-module. This vulnerability allows an attacker to provide a crafted XFA file within a PDF, read sensitive data, or trigger malicious requests to internal resources or third-party servers. Mitigation Mitigation for...

ai.driftkit:driftkit-context-engineering-spring-ai-starter (>=0.6.0, <=0.9.2), ai.driftkit:driftkit-context-engineering-spring-boot-starter (>=0.5.0, <=0.9.2) +337 more potentially affected by CVE-2025-54988 via org.apache.tika:tika-parser-pdf-module (>=2.0.0-alpha, <=3.2.1)

org.apache.tika:tika-parser-pdf-module MAVEN version =2.0.0-alpha, =0.6.0, =0.5.0, =0.7.0, =0.7.0, =0.5.0, =0.8.3, =0.8.3, =0.8.3, =0.5.0, =0.5.0, =1.2.0, =1.0.3.1-jdk21, =1.0.0, =1.0.0, =1.0, =1.4 and more Source cves: CVE-2025-54988 Source advisory: OSV:GHSA-P72G-PV48-7W9X...

ai.driftkit:driftkit-context-engineering-spring-ai-starter (>=0.6.0, <=0.9.2), ai.driftkit:driftkit-context-engineering-spring-boot-starter (>=0.5.0, <=0.9.2) +337 more potentially affected by CVE-2025-54988 via org.apache.tika:tika-parser-pdf-module (>=2.0.0-alpha, <=3.2.1)

org.apache.tika:tika-parser-pdf-module MAVEN version =2.0.0-alpha, =0.6.0, =0.5.0, =0.7.0, =0.7.0, =0.5.0, =0.8.3, =0.8.3, =0.8.3, =0.5.0, =0.5.0, =1.2.0, =1.0.3.1-jdk21, =1.0.0, =1.0.0, =1.0, =1.4 and more Source cves: CVE-2025-54988 Source advisory: GHSA-P72G-PV48-7W9X...

CVE-2025-54988 Apache Tika PDF parser module: XXE vulnerability in PDFParser's handling of XFA

Critical XXE in Apache Tika tika-parser-pdf-module in Apache Tika 1.13 through and including 3.2.1 on all platforms allows an attacker to carry out XML External Entity injection via a crafted XFA file inside of a PDF. An attacker may be able to read sensitive data or trigger malicious requests to...

CVE-2025-54988

Critical XXE in Apache Tika tika-parser-pdf-module in Apache Tika 1.13 through and including 3.2.1 on all platforms allows an attacker to carry out XML External Entity injection via a crafted XFA file inside of a PDF. An attacker may be able to read sensitive data or trigger malicious requests to...

CVE-2025-54988

A critical XML External Entity (XXE) injection vulnerability exists in Apache Tika (specifically affecting tika-core versions 1.13 through 3.2.1, tika-pdf-module versions 2.0.0 through 3.2.1, and tika-parsers versions 1.13 through 1.28.5). The root cause is an incorrect limitation on XML links to...

ai.driftkit:driftkit-context-engineering-spring-ai-starter (>=0.6.0, <=0.9.2), ai.driftkit:driftkit-context-engineering-spring-boot-starter (>=0.5.0, <=0.9.2) +337 more potentially affected by CVE-2025-54988 via org.apache.tika:tika-parser-pdf-module (>=2.0.0-alpha, <=3.2.1)

org.apache.tika:tika-parser-pdf-module MAVEN version =2.0.0-alpha, =0.6.0, =0.5.0, =0.7.0, =0.7.0, =0.5.0, =0.8.3, =0.8.3, =0.8.3, =0.5.0, =0.5.0, =1.2.0, =1.0.3.1-jdk21, =1.0.0, =1.0.0, =1.0, =1.4 and more Source cves: CVE-2025-54988 Source advisory: MEND:CVE-2025-54988...

CVE-2025-54988: Improper Restriction of XML External Entity Reference

Critical XXE in Apache Tika tika-parser-pdf-module in Apache Tika 1.13 through and including 3.2.1 on all platforms allows an attacker to carry out XML External Entity injection via a crafted XFA file inside of a PDF. An attacker may be able to read sensitive data or trigger malicious requests to...