What is the CVSS score of EUVD-2025-201189?

EUVD-2025-201189 has a contested CVSS base score of 8.4 from a third party (e.g. CISA-ADP), while the vendor rates it High. vuln.today uses the vendor rating as authoritative.

Is there a public PoC exploit available for EUVD-2025-201189?

Yes, a public proof-of-concept exploit is available for EUVD-2025-201189. Prioritise patching immediately. EPSS: 1.5%.

How to fix or mitigate EUVD-2025-201189?

Within 24 hours: Inventory all systems using Apache Tika (tika-core, tika-pdf-module, tika-parsers) and identify affected versions; disable PDF processing capabilities or restrict PDF uploads if operationally feasible; enable logging for PDF file submissions. Within 7 days: Implement network-level controls to isolate systems running vulnerable Tika instances; deploy WAF rules to block requests containing suspicious XFA/XML payloads; prepare change management for rapid patch deployment. Within 30 days: Monitor Apache Tika security advisories for patch release (expected soon); coordinate vendor patch testing and deployment across all affected systems; validate that upgrades include tika-core version >= 3.2.2 (not just pdf-module alone).

Tika EUVD-2025-201189

Q: Which versions of Tika are affected by EUVD-2025-201189?

Apache Tika versions 1.13-3.2.1 contain a critical XML External Entity (XXE) injection vulnerability exploitable through crafted PDF files, potentially allowing attackers to read sensitive files or…. A patch is available.

| CVE-2025-66516 HIGH

Improper Restriction of XML External Entity Reference (CWE-611)

2025-12-04 security@apache.org

GHSA-f58c-gq56-vjjf

Apache XXE Debian Ubuntu Red Hat Tika

High

Disputed · 8.4 NVD

View

Vulnerability Assessment

Weakness	CWE CWE-611 OWASP Top 10:2025 A02:2025 - Security Misconfiguration ASVS 5.0 V13 - Configuration XML external entity prevention MITRE ATT&CK 2 techniques across 2 tactics: Initial Access, Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Impact	CVSS score of 8.4 (HIGH).

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

Patch available 1.5% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 15, 2026

Critical XXE in Apache Tika tika-core (1.13-3.2.1), tika-pdf-module (2.0.0-3.2.1) and tika-parsers (1.13-1.28.5) modules on all platforms allows an attacker to carry out XML External Entity injection via a crafted XFA file inside of a PDF.

This CVE covers the same vulnerability as in CVE-2025-54988. However, this CVE expands the scope of affected packages in two ways.

First, while the entrypoint for the vulnerability was the tika-parser-pdf-module as reported in CVE-2025-54988, the vulnerability and its fix were in tika-core. Users who upgraded the tika-parser-pdf-module but did not upgrade tika-core to >= 3.2.2 would still be vulnerable.

Second, the original report failed to mention that in the 1.x Tika releases, the PDFParser was in the "org.apache.tika:tika-parsers" module.

Earlier versions of this analysis (1)

v1 Mar 15, 2026 - 16:35 CVSS 8.4

RemediationAI

Monitor vendor advisories for patches. Apply mitigations such as network segmentation, access restrictions, and monitoring.

Affected VersionsENISA

Apache Tika parsers 1.13 <2.0.0

Apache Tika PDF parser module 2.0.0 ≤3.2.1

Apache Tika core 1.13 ≤3.2.1

Affected Packages

maven org.apache.tika:tika-core fix: 3.2.2

maven org.apache.tika:tika-parser-pdf-module fix: 3.2.2

maven org.apache.tika:tika-parsers fix: 2.0.0

euvd apache_tika_core no fix

euvd apache_tika_parsers fix: 2.0.0

euvd apache_tika_pdf_parser_module no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 6 packages in maven, euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

This vulnerability is classified as Improper Restriction of XML External Entity Reference (CWE-611).

Know when Tika gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Sources disagree (Medium–Critical)

NVD PRIMARY 8.4 HIGH

AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Ubuntu MEDIUM

Red Hat 10.0 CRITICAL

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

CVE Published

Dec 04, 2025 - 17:15 nvd

HIGH 8.4

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

121 maven packages depend on org.apache.tika:tika-core (41 direct, 80 indirect)
12 maven packages depend on org.apache.tika:tika-parser-pdf-module (3 direct, 9 indirect)
71 maven packages depend on org.apache.tika:tika-parsers (31 direct, 40 indirect)

Ecosystem-wide dependent count for version 1.13 and other introduced versions.

Executive ViewAI

Why It Matters

Apache Tika versions 1.13-3.2.1 contain a critical XML External Entity (XXE) injection vulnerability exploitable through crafted PDF files, potentially allowing attackers to read sensitive files or execute denial-of-service attacks. Organizations using affected Tika versions for document processing face immediate risk, as no patch is currently available and the vulnerability impacts multiple module configurations that users may have overlooked during previous remediation attempts.

Business Impact: High

Compensating Controls

Disable XFA (XDP) form processing in PDF parsers if supported by your implementation; implement strict file upload validation rejecting PDFs with XFA components; segment document processing systems on isolated networks with no outbound access; deploy WAF rules blocking XML entity declarations and external entity references; apply principle of least privilege to Tika process credentials; consider temporary suspension of untrusted PDF processing until patch availability; monitor for exploitation attempts in Tika process logs and system file access patterns.

Threat Intelligence Overview

EPSS Score

1.5%

Top 19% exploitable

Exploit

POC

Public exploit code exists

Data Quality

6 sources

Confidence: High

EUVD

NVD

CVE.org

EPSS POC (2) Vendor

GitHub

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC Yes

EPSS 1.5%

Patch available Yes

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Scheduled

Exploitation· derived

Poc

System Exposure· derived

Small

Automatable· derived

Human Impact

High

Priority Score

Low Medium High Critical

KEV: 0

EPSS: +1

CVSS: +42

PoC: +20

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

XML External Entity Injection HIGH

XML External Entity (XXE) attacks exploit XML parsers that process Document Type Definitions (DTDs) without proper restrictions.

More in Tika

View all

CVE-2018-1335 HIGH Act Now POC

8.1 Apr 25

From Apache Tika versions 1.7 to 1.17, clients could send carefully crafted headers to tika-server that could be used to

CVE-2025-54988 HIGH This Week POC

8.4 Aug 20

Critical XXE in Apache Tika (tika-parser-pdf-module) in Apache Tika 1.13 through and including 3.2.1 on all platforms al

CVE-2021-33813 HIGH This Week POC

7.5 Jun 16

An XXE issue in SAXBuilder in JDOM through 2.0.6 allows attackers to cause a denial of service via a crafted HTTP reques

CVE-2016-6809 CRITICAL Act Now

9.8 Apr 06

Apache Tika before 1.14 allows Java code execution for serialized objects embedded in MATLAB files. Rated critical sever

CVE-2019-10088 HIGH This Week

8.8 Aug 02

A carefully crafted or corrupt zip file can cause an OOM in Apache Tika's RecursiveParserWrapper in versions 1.7-1.21. R

CVE-2016-4434 HIGH This Week

7.8 Sep 30

Apache Tika before 1.13 does not properly initialize the XML parser or choose handlers, which might allow remote attacke

CVE-2019-10094 HIGH This Week

7.8 Aug 02

A carefully crafted package/compressed file that, when unzipped/uncompressed yields the same file (a quine), causes a St

CVE-2018-11796 HIGH This Week

7.5 Oct 09

In Apache Tika 1.19 (CVE-2018-11761), we added an entity expansion limit for XML parsing. Rated high severity (CVSS 7.5)

CVE-2018-11761 HIGH This Week

7.5 Sep 19

In Apache Tika 0.1 to 1.18, the XML parsers were not configured to limit entity expansion. Rated high severity (CVSS 7.5

CVE-2026-66756 MEDIUM This Month

6.9 Jul 30

The /unpack endpoint in Apache Tika's server component (tika-server 4.0.0-alpha-1) fails to enforce the operator-configu

CVE-2019-10093 MEDIUM This Month

6.5 Aug 02

In Apache Tika 1.19 to 1.21, a carefully crafted 2003ml or 2006ml file could consume all available SAXParsers in the poo

CVE-2018-17197 MEDIUM This Month

6.5 Dec 24

A carefully crafted or corrupt sqlite file can cause an infinite loop in Apache Tika's SQLite3Parser in versions 1.8-1.1

Same weakness CWE-611 – Improper Restriction of XML External Entity Reference

View all

CVE-2019-9670 CRITICAL POC

9.8

CVE-2025-58360 CRITICAL POC

9.8

CVE-2025-2775 CRITICAL POC

9.3

CVE-2025-2776 CRITICAL POC

9.3

CVE-2017-12629 CRITICAL POC

9.8

CVE-2016-9563 MEDIUM POC

6.5

CVE-2012-3363 CRITICAL POC

9.1

CVE-2016-4264 HIGH POC

8.6

Same technique XXE

View all

CVE-2013-5014 HIGH POC

7.5

CVE-2015-0923 MEDIUM POC

5.0

CVE-2014-0644 HIGH POC

7.8

Vendor StatusVendor

Ubuntu

Priority: Medium

tika

Release	Status	Version
xenial	needs-triage	-
bionic	needs-triage	-
focal	needs-triage	-
jammy	needs-triage	-
noble	needs-triage	-
questing	needs-triage	-
upstream	needs-triage	-
plucky	ignored	end of life, was needs-triage

Debian

Bug #1121954

tika

Release	Status	Fixed Version	Urgency
bullseye, sid	vulnerable	1.22-2	-
bullseye (security)	fixed	1.22-2+deb11u1	-
bullseye	fixed	1.22-2+deb11u1	-
(unstable)	fixed	(unfixed)	-

DLA-4350-1

References

Advisories & patches

ADVISORY https://access.redhat.com/errata/RHSA-2025:23143 ADVISORY https://access.redhat.com/errata/RHSA-2025:23225 ADVISORY https://github.com/apache/tika ADVISORY https://lists.apache.org/thread/s5x3k93nhbkqzztp1olxotoyjpdlps9k ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2025-66516 ADVISORY https://security-tracker.debian.org/tracker/dla-4350-1 REF https://cve.org/CVERecord?id=CVE-2025-54988

Search Externally

GitHub PoC

Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC

Back