Free practical cybersecurity guidance for organisations without a security team.
hello@actionsoncyber.com
Actions On Cyber logo
Contact
← Back to Vulnerability Briefs

Critical Vulnerability in Apache Tika Could Let Attackers Access Your Files

A serious security flaw has been found in Apache Tika, a software tool used to extract data from files like PDFs. This flaw could let attackers exploit specially crafted PDF files to access or damage your data. It’s important to check if your systems use this software and update it promptly.

14 September 2026

Reference: CVE-2025-66516

1. What is being reported?

The vulnerability involves a problem called XML External Entity (XXE) injection in Apache Tika’s core and PDF parsing components. Attackers can use a manipulated PDF file containing a specific type of embedded form to trick the software into revealing sensitive information or running harmful actions.

2. What this means in plain English

If your organisation uses software that relies on Apache Tika to process PDF files, an attacker could send you a malicious PDF that exploits this flaw. This could lead to unauthorised access to your data or disruption of your services.

3. Could this affect a small business?

Small businesses or charities using software that includes Apache Tika, especially for handling PDFs, could be at risk. If you don’t use such software or only open PDFs from trusted sources, the risk is lower. Ask your IT provider if your systems use Apache Tika and which versions.

4. What to do now

  • Ask your IT provider or software supplier if your systems use Apache Tika and confirm the version.
  • Ensure Apache Tika is updated to version 3.2.2 or later, or the equivalent patched version in your software.
  • Avoid opening PDF files from unknown or untrusted sources until the issue is resolved.
  • Monitor for any unusual activity related to file processing or document handling in your systems.

5. Ask your IT provider

Can you confirm if any of our software uses Apache Tika, and if so, has it been updated to fix the CVE-2025-66516 vulnerability?

6. Bottom line

Check and update Apache Tika promptly to protect your organisation from this serious PDF-related security flaw.

Information based on CISA KEV, NVD, and reputable security reporting.

Back to Vulnerability Briefs