Apache Tika PDF parser hit by CVSS 10.0 XXE flaw via XFA

Apache Tika's PDF module is affected by CVE-2025-66516, a CVSS 10.0 XXE vulnerability: crafted XFA blocks let the parser resolve external entities, enabling local file reads and outbound requests from the host. The flaw is fixed in Tika 3.2.2, which also covers CVE-2026-66755 in the core and alpha branches.

• CVE-2025-66516 carries the maximum CVSS score of 10.0
• Affected ranges span core, parsers and PDF modules depending on version
• The fix ships in Apache Tika 3.2.2
• Disabling external entities and sandboxing extraction are recommended