ALL POSTS

Key Findings A critical XXE vulnerability (CVE-2025-66516) with a CVSS score of 10.0 was discovered in Apache Tika The vulnerability allows XML external entity attacks and affects Tika's core, PDF, and parser modules Attackers can embed a malicious XFA file inside a PDF to trigger the XXE injection in Tika Background Apache Tika is an open-source content analysis toolkit used to extract text, metadata, and structured information from various file types Tika is widely used in

Key Findings A critical XML external entity (XXE) vulnerability, tracked as CVE-2025-66516, has been discovered in the Apache Tika toolkit. The vulnerability has a CVSS score of 10.0, indicating maximum severity. The flaw allows attackers to carry out XXE injection attacks by exploiting a crafted XFA file within a PDF document. The vulnerability affects multiple Apache Tika components, including the tika-core, tika-parser-pdf-module, and tika-parsers modules. This vulnerabili