CVE-2025-66516 is an XML External Entity (XXE) vulnerability classified under CWE-611, affecting the Apache Software Foundation's Apache Tika core and associated modules (tika-core versions 1.13 through 3.2.1, tika-pdf-module 2.0.0 through 3.2.1, and tika-parsers 1.13 through 1.28.5). The vulnerability stems from improper restriction of XML external entity references during the parsing of XFA (XML Forms Architecture) files embedded within PDF documents. Attackers can craft malicious PDFs containing specially designed XFA content that triggers the XXE flaw, allowing them to read arbitrary files, cause denial of service, or potentially execute code depending on the environment. The vulnerability was initially reported as CVE-2025-54988, focusing on tika-parser-pdf-module, but CVE-2025-66516 expands the scope to include tika-core and tika-parsers modules, clarifying that partial upgrades leave systems vulnerable. The CVSS v3.1 base score is 8.4, reflecting high severity with attack vector local (AV:L), low attack complexity (AC:L), no privileges required (PR:N), no user interaction (UI:N), unchanged scope (S:U), and high impact on confidentiality, integrity, and availability (C:H/I:H/A:H). Exploitation requires the ability to submit or process crafted PDFs locally or in an environment where Tika processes untrusted documents automatically. The vulnerability affects all platforms supported by Apache Tika. No known exploits in the wild have been reported yet, but the potential impact is significant due to the widespread use of Apache Tika for content detection and metadata extraction in enterprise document workflows. The fix is included in tika-core version 3.2.2 and later; users must upgrade all related modules to fully remediate the issue.

For European organizations, the impact of CVE-2025-66516 can be severe. Apache Tika is widely used in document processing pipelines, content management systems, and data extraction tools across various sectors including finance, government, healthcare, and legal services. Exploitation of this XXE vulnerability could lead to unauthorized disclosure of sensitive information, including internal files and credentials, undermining confidentiality. Integrity could be compromised if attackers manipulate parsed data or inject malicious content. Availability may also be affected through denial-of-service conditions caused by crafted XML payloads. Given the local attack vector, environments that automatically process untrusted PDFs—such as email gateways, document ingestion services, or automated compliance systems—are at heightened risk. The vulnerability could facilitate lateral movement within networks or data exfiltration, impacting compliance with GDPR and other data protection regulations. The lack of required privileges or user interaction lowers the barrier for exploitation in multi-tenant or cloud environments. Consequently, organizations face potential regulatory penalties, reputational damage, and operational disruption if this vulnerability is exploited.

To mitigate CVE-2025-66516 effectively, European organizations should: 1) Perform a comprehensive inventory of all Apache Tika components in use, including tika-core, tika-pdf-module, and tika-parsers, across all systems and environments. 2) Upgrade all affected Apache Tika modules to version 3.2.2 or later simultaneously to ensure complete remediation, avoiding partial upgrades that leave tika-core vulnerable. 3) Implement strict input validation and sanitization for all PDF files processed, especially those containing XFA forms, to detect and block malicious XML entities. 4) Where feasible, sandbox or isolate document processing workflows to limit the impact of potential exploitation, using containerization or dedicated parsing services with minimal privileges. 5) Monitor logs and network traffic for unusual file access patterns or XML parsing errors indicative of XXE exploitation attempts. 6) Review and tighten file system permissions for services running Apache Tika to minimize data exposure in case of compromise. 7) Educate developers and system administrators about the risks of XXE and the importance of coordinated module upgrades. 8) Consider deploying runtime application self-protection (RASP) or web application firewalls (WAFs) with XXE detection capabilities to provide an additional layer of defense.