CVE-2025-66516: MAXIMUM-SEVERITY VULNERABILITY IN APACHE TIKA COULD LEAD TO XML EXTERNAL ENTITY INJECTION ATTACK

Summary from the TLDR InfoSec newsletter

A newly disclosed XXE vulnerability, CVE-2025-66516, affects several Apache Tika components and allows attackers to embed malicious XFA content in PDFs, potentially exposing sensitive server files or enabling remote code execution. Upgrade all affected Tika modules ASAP.