Critical XXE Bug CVE-2025-66516 (CVSS 10.0) Hits Apache Tika, Requires Urgent Patch

A critical XML external entity (XXE) injection vulnerability CVE-2025-66516 has been discovered in Apache Tika with a maximum CVSS score of 10.0. The flaw affects multiple Apache Tika modules including tika-core (versions 1.13-3.2.1), tika-pdf-module (versions 2.0.0-3.2.1), and tika-parsers (versions 1.13-1.28.5) across all platforms. Due to the critical severity rating and potential for XXE attacks, this vulnerability requires urgent patching.