What is the CVSS score of CVE-2025-66516?

CVE-2025-66516 has a contested CVSS base score of 8.4 from a third party (e.g. CISA-ADP), while the vendor rates it High. vuln.today uses the vendor rating as authoritative.

Which versions of Ubuntu are affected by CVE-2025-66516?

Apache Tika versions 1.13-3.2.1 contain a critical XML External Entity (XXE) injection vulnerability exploitable through crafted PDF files, potentially allowing attackers to read sensitive files or…. A patch is available.

Is there a public PoC exploit available for CVE-2025-66516?

Yes, a public proof-of-concept exploit is available for CVE-2025-66516. Prioritise patching immediately. EPSS: 1.5%.

How to fix or mitigate CVE-2025-66516?

Within 24 hours: Inventory all systems using Apache Tika (tika-core, tika-pdf-module, tika-parsers) and identify affected versions; disable PDF processing capabilities or restrict PDF uploads if operationally feasible; enable logging for PDF file submissions. Within 7 days: Implement network-level controls to isolate systems running vulnerable Tika instances; deploy WAF rules to block requests containing suspicious XFA/XML payloads; prepare change management for rapid patch deployment. Within 30 days: Monitor Apache Tika security advisories for patch release (expected soon); coordinate vendor patch testing and deployment across all affected systems; validate that upgrades include tika-core version >= 3.2.2 (not just pdf-module alone).

Ubuntu CVE-2025-66516

EUVD-2025-201189 HIGH

Improper Restriction of XML External Entity Reference (CWE-611)

2025-12-04 security@apache.org

GHSA-f58c-gq56-vjjf

XXE Apache Ubuntu Debian Tika Red Hat

High

Disputed · 8.4 NVD

Severity by source

Sources disagree (Medium–Critical)

NVD PRIMARY

8.4 HIGH

AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Ubuntu

MEDIUM

qualitative

Red Hat

10.0 CRITICAL

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

EUVD ID Assigned

Mar 15, 2026 - 16:35 euvd

EUVD-2025-201189

Analysis Generated

Mar 15, 2026 - 16:35 vuln.today

CVE Published

Dec 04, 2025 - 17:15 nvd

HIGH 8.4

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

121 maven packages depend on org.apache.tika:tika-core (41 direct, 80 indirect)
12 maven packages depend on org.apache.tika:tika-parser-pdf-module (3 direct, 9 indirect)
71 maven packages depend on org.apache.tika:tika-parsers (31 direct, 40 indirect)

Ecosystem-wide dependent count for version 1.13 and other introduced versions.

DescriptionCVE.org

Critical XXE in Apache Tika tika-core (1.13-3.2.1), tika-pdf-module (2.0.0-3.2.1) and tika-parsers (1.13-1.28.5) modules on all platforms allows an attacker to carry out XML External Entity injection via a crafted XFA file inside of a PDF.

This CVE covers the same vulnerability as in CVE-2025-54988. However, this CVE expands the scope of affected packages in two ways.

First, while the entrypoint for the vulnerability was the tika-parser-pdf-module as reported in CVE-2025-54988, the vulnerability and its fix were in tika-core. Users who upgraded the tika-parser-pdf-module but did not upgrade tika-core to >= 3.2.2 would still be vulnerable.

Second, the original report failed to mention that in the 1.x Tika releases, the PDFParser was in the "org.apache.tika:tika-parsers" module.

Analysis

This CVE covers the same vulnerability as in CVE-2025-54988. However, this CVE expands the scope of affected packages in two ways.

Second, the original report failed to mention that in the 1.x Tika releases, the PDFParser was in the "org.apache.tika:tika-parsers" module.

Technical ContextAI

This vulnerability is classified as Improper Restriction of XML External Entity Reference (CWE-611).

RemediationAI

Monitor vendor advisories for patches. Apply mitigations such as network segmentation, access restrictions, and monitoring.

More in Tika

View all

CVE-2018-1335 HIGH Act Now POC

8.1 Apr 25

From Apache Tika versions 1.7 to 1.17, clients could send carefully crafted headers to tika-server that could be used to

CVE-2025-54988 HIGH This Week POC

8.4 Aug 20

Critical XXE in Apache Tika (tika-parser-pdf-module) in Apache Tika 1.13 through and including 3.2.1 on all platforms al

CVE-2021-33813 HIGH This Week POC

7.5 Jun 16

An XXE issue in SAXBuilder in JDOM through 2.0.6 allows attackers to cause a denial of service via a crafted HTTP reques

CVE-2016-6809 CRITICAL Act Now

9.8 Apr 06

Apache Tika before 1.14 allows Java code execution for serialized objects embedded in MATLAB files. Rated critical sever

CVE-2019-10088 HIGH This Week

8.8 Aug 02

A carefully crafted or corrupt zip file can cause an OOM in Apache Tika's RecursiveParserWrapper in versions 1.7-1.21. R

CVE-2016-4434 HIGH This Week

7.8 Sep 30

Apache Tika before 1.13 does not properly initialize the XML parser or choose handlers, which might allow remote attacke

CVE-2019-10094 HIGH This Week

7.8 Aug 02

A carefully crafted package/compressed file that, when unzipped/uncompressed yields the same file (a quine), causes a St

CVE-2018-11796 HIGH This Week

7.5 Oct 09

In Apache Tika 1.19 (CVE-2018-11761), we added an entity expansion limit for XML parsing. Rated high severity (CVSS 7.5)

CVE-2018-11761 HIGH This Week

7.5 Sep 19

In Apache Tika 0.1 to 1.18, the XML parsers were not configured to limit entity expansion. Rated high severity (CVSS 7.5

CVE-2026-66756 MEDIUM This Month

6.9 Jul 30

The /unpack endpoint in Apache Tika's server component (tika-server 4.0.0-alpha-1) fails to enforce the operator-configu

CVE-2019-10093 MEDIUM This Month

6.5 Aug 02

In Apache Tika 1.19 to 1.21, a carefully crafted 2003ml or 2006ml file could consume all available SAXParsers in the poo

CVE-2018-17197 MEDIUM This Month

6.5 Dec 24

A carefully crafted or corrupt sqlite file can cause an infinite loop in Apache Tika's SQLite3Parser in versions 1.8-1.1

Same weakness CWE-611 – Improper Restriction of XML External Entity Reference

View all

CVE-2019-9670 CRITICAL POC

9.8

CVE-2025-58360 HIGH POC

8.2

CVE-2025-2775 CRITICAL POC

9.3

CVE-2025-2776 CRITICAL POC

9.3

CVE-2017-12629 CRITICAL POC

9.8

CVE-2016-9563 MEDIUM POC

6.5

CVE-2012-3363 CRITICAL POC

9.1

CVE-2016-4264 HIGH POC

8.6

Same technique XXE

View all

CVE-2025-58360 HIGH POC

8.2

CVE-2025-2775 CRITICAL POC

9.3

CVE-2025-2776 CRITICAL POC

9.3

CVE-2017-12629 CRITICAL POC

9.8

CVE-2016-9563 MEDIUM POC

6.5

CVE-2013-5014 HIGH POC

7.5

CVE-2015-0923 MEDIUM POC

5.0

CVE-2014-0644 HIGH POC

7.8

Vendor StatusVendor

Ubuntu

Priority: Medium

tika

Release	Status	Version
xenial	needs-triage	-
bionic	needs-triage	-
focal	needs-triage	-
jammy	needs-triage	-
noble	needs-triage	-
questing	needs-triage	-
upstream	needs-triage	-
plucky	ignored	end of life, was needs-triage

Debian

Bug #1121954

tika

Release	Status	Fixed Version	Urgency
bullseye, sid	vulnerable	1.22-2	-
bullseye (security)	fixed	1.22-2+deb11u1	-
bullseye	fixed	1.22-2+deb11u1	-
(unstable)	fixed	(unfixed)	-

DLA-4350-1

CVE-2025-66516 vulnerability details – vuln.today

Back

Ubuntu CVE-2025-66516

Severity by source

CVSS VectorNVD

Lifecycle Timeline

Blast Radius

DescriptionCVE.org

Analysis

Technical ContextAI

RemediationAI

More in Tika

Same weakness CWE-611 – Improper Restriction of XML External Entity Reference

Same technique XXE

Vendor StatusVendor

Ubuntu

Debian

Share

External POC / Exploit Code