CVE-2025-66516 Minimal Verification Environment

This project is used to verify CVE-2025-66516 (XML External Entity Injection Vulnerability in Apache Tika).

Vulnerability Description

Apache Tika 3.2.1 and earlier versions, when parsing PDF files containing XFA forms, did not properly disable external entity loading, leading to an XXE vulnerability. An attacker can construct a malicious PDF file to read sensitive files on the server.

Requirements

• JDK 11+
• Maven

Usage

1. Generate Malicious Payload

Run the org.example.ExploitGenerator class.

This program will generate poc-xxe.pdf in the current directory.

• Windows: Attempts to read C:/Windows/win.ini
• Linux/Mac: Attempts to read /etc/passwd

2. Perform Vulnerability Verification

Run the org.example.VulnerabilityVerifier class.

This program uses Tika to parse the generated poc-xxe.pdf. If the vulnerability exists, the console will output the file content read (wrapped by HACKED_START and HACKED_END).

Fix Recommendation

Upgrade Apache Tika to 3.3.0 or later.