CVE-2025-66516-Writeup-POC

CVE-2025-66516: Critical XXE Vulnerability in Apache Tika Executive Summary CVE-2025-66516 is a critical XML External Entity XXE injection vulnerability in Apache Tika with a CVSS score of 10.0 maximum severity. The vulnerability allows remote attackers to read arbitrary files, perform Server-Sid...

CVE-2025-66516-POC

⚠️ 使用前请阅读免责声明 ⚠️ 仅限教育/授权测试 | 许可证 | 安全政策 关于此POC 本仓库包含针对 CVE-2025-66516 的概念验证（POC）利用代码，该漏洞是 Apache Tika 3.2.2 之前版本中的一个 XML 外部实体（XXE）注入漏洞 。漏洞影响 tika-parser-pdf-module 组件中的 XFA（XML 表单架构）解析器 ，允许攻击者通过精心构造的 PDF 文档读取本地文件并窃取敏感数据。 什么是 CVE-2025-66516？ CVE-2025-66516 是 Apache Tika PDF 解析功能中的一个 严重安全漏洞 。在处理包含嵌入式...

CVE-2021-45067

CVE-2021-45067 This bug was Out of Bounds Read caused by treating ANSI string as Unicode which can be exploited to leak sensitive information from the sandboxed adobe reader process. Blog Adobe Reader - XFA - ANSI - Unicode Confusion Information Leak Advisory CVE-2021-45067 Demo...

Tika-CVE-2025-66516-Lab

CVE-2025-66516 Minimal Verification Environment This project is used to verify CVE-2025-66516 XML External Entity Injection Vulnerability in Apache Tika. Vulnerability Description Apache Tika 3.2.1 and earlier versions, when parsing PDF files containing XFA forms, did not properly disable externa...

Blackash-CVE-2025-66516

🚨 CVE-2025-66516 — Apache Tika 严重漏洞 CVSS: 10.0 | 漏洞类型: XXE 注入 | 风险等级: 最高 🎯 执行摘要 CVE-2025-66516 是 Apache Tika 核心处理引擎中的一个严重 XML 外部实体 XXE 漏洞。 单个包含 XFA 内容的恶意 PDF 可触发： 🔓 敏感文件泄露 🌐 服务器端请求伪造 SSRF 💻 潜在的远程代码执行 RCE 该漏洞影响全球数百万文档处理管道 。 🧨 根本原因是什么？ 🚩 对嵌入在 PDF 的 XFA 表单 中的外部 XML 实体 进行了不安全处理。 当 Apache Tika 解析这些文档时...

POC-CVE-2025-54988

CVE-2025-54988 - POC Aviso legal: No soy el descubridor original de esta vulnerabilidad. Esta publicación documenta mi proceso de reproducción del problema en un entorno controlado con fines educativos y para ayudar a otros a validar sus propios sistemas. Las pruebas se realizaron en un laborator...

GHSA-36MM-W85J-3Q2J veraPDF Validation XXE via XFA

Summary Description An XML External Entity Injection CWE-611 vulnerability in veraPDF allows a remote attacker to read arbitrary files on the server file system and perform Server-Side Request Forgery by submitting a crafted PDF containing a malicious XFA stream. This affects all current versions...

CVE-2026-54079 veraPDF Validation XXE via XFA

veraPDF validation provides PDF/A and PDF/UA validation, feature reporting, and metadata repair. From 1.17.35 until 1.30.2 and 1.31.71, veraPDF-validation contains an XML External Entity XXE vulnerability in validation-model/src/main/java/org/verapdf/gf/model/impl/pd/GFPDAcroForm.java in the...

EUVD-2026-50368

veraPDF validation provides PDF/A and PDF/UA validation, feature reporting, and metadata repair. From 1.17.35 until 1.30.2 and 1.31.71, veraPDF-validation contains an XML External Entity XXE vulnerability in validation-model/src/main/java/org/verapdf/gf/model/impl/pd/GFPDAcroForm.java in the...

PYSEC-2026-3027 pypdf: Manipulated FlateDecode XFA streams can exhaust RAM

Impact An attacker who uses this vulnerability can craft a PDF which leads to the RAM being exhausted. This requires accessing the xfa property of a reader or writer and the corresponding stream being compressed using /FlateDecode. Patches This has been fixed in pypdf==6.7.3. Workarounds If...

Security Bulletin: Critical XXE Vulnerability in Apache Tika Affecting Content Collector for Email, File Systems, and Microsoft SharePoint (CVE-2025-66516)

Summary Critical XML External Entity in Apache Tika on all platforms allows an attacker to carry out XML External Entity injection via a crafted XFA file inside of a PDF. An attacker may be able to read sensitive data or trigger malicious requests to internal resources or third-party...

CVE-2025-66769

A NULL pointer dereference in Nitro PDF Pro for Windows v14.41.1.4 allows attackers to cause a Denial of Service DoS via a crafted XFA packet...

CVE-2026-5939

A crafted XFA PDF can trigger a use-after-free condition during calculate event processing, causing the application to crash and resulting in an arbitrary code execution...

CVE-2026-5939

CVE-2026-5939 describes a use-after-free (UAF) vulnerability in Foxit PDF Editor/Reader triggered by a crafted XFA PDF during the calculate event. The issue affects the application when processing XFA calculate logic, potentially crashing the program and enabling arbitrary code execution. The lin...

CVE-2026-5939 UAF in Foxit PDF Editor/Reader via XFA calculate event

A crafted XFA PDF can trigger a use-after-free condition during calculate event processing, causing the application to crash and resulting in an arbitrary code execution...

EUVD-2025-209415

A NULL pointer dereference in Nitro PDF Pro for Windows v14.41.1.4 allows attackers to cause a Denial of Service DoS via a crafted XFA packet...

PT-2026-32375

A NULL pointer dereference in Nitro PDF Pro for Windows v14.41.1.4 allows attackers to cause a Denial of Service DoS via a crafted XFA packet...

CVE-2025-66769

A NULL pointer dereference in Nitro PDF Pro for Windows v14.41.1.4 allows attackers to cause a Denial of Service DoS via a crafted XFA packet...

OPENSUSE-SU-2026:20333-1 Security update for python-PyPDF2

This update for python-PyPDF2 fixes the following issues: Changes in python-PyPDF2: - CVE-2026-27628: Fixed infinite loop when loading circular /Prev entries in cross-reference streams bsc1258940 - CVE-2026-27888: Fixed issue where manipulated FlateDecode XFA streams can exhaust RAM bsc1258934 -...

📄 pypdf Memory Exhaustion / Denial of Service

pypdf versions prior to 6.7.3 were vulnerable to a denial of service condition caused by uncontrolled memory allocation during decompression of XFA streams. An attacker could craft a malicious PDF file containing a highly compressed stream using /FlateDecode...