CVE-2025-66516: Apache Solr extraction module vulnerable to XXE attacks via XFA content in PDFs

{
  "id": "9d6476905f2e76e5fc8a4b617ec9550905f3fb4319767170e5e880afda1ede64",
  "url": "https://solr.apache.org/cve-2025-66516-apache-solr-extraction-module-vulnerable-to-xxe-attacks-via-xfa-content-in-pdfs.html",
  "method": "llm",
  "payload": {
    "kind": "mitigation",
    "title": "CVE-2025-66516: Apache Solr extraction module vulnerable to XXE attacks via XFA content in PDFs",
    "summary": "A vulnerability in the Tika-based Solr extraction module can let specially crafted PDFs read server files. The announcement recommends disabling XFA form parsing as a mitigation; it does not state a fixed release version.",
    "evidence": "A vulnerability in Tika allows attackers to submit specially crafted PDFs that can read files from the server.",
    "products": [
      {
        "name": {
          "value": "Apache Solr",
          "evidence": "Versions Affected Apache Solr 6.2.0 through 9.10.0 (when using the extraction module)"
        },
        "prerequisites": [
          {
            "value": "when using the extraction module",
            "evidence": "Versions Affected Apache Solr 6.2.0 through 9.10.0 (when using the extraction module)"
          },
          {
            "value": "using the extraction module with the 'local' backend (default)",
            "evidence": "Solr instances using the extraction module with the 'local' backend (default)"
          },
          {
            "value": "allow untrusted users to upload PDF files for indexing",
            "evidence": "Systems that allow untrusted users to upload PDF files for indexing"
          }
        ],
        "fixed_versions": [],
        "affected_versions": [
          {
            "value": "6.2.0 through 9.10.0",
            "evidence": "Versions Affected Apache Solr 6.2.0 through 9.10.0 (when using the extraction module)"
          }
        ]
      }
    ],
    "severity": "high",
    "fixed_cves": [],
    "related_cves": [
      {
        "value": "CVE-2025-66516",
        "evidence": "CVE - CVE-2025-66516 (supersedes CVE-2025-54988)"
      },
      {
        "value": "CVE-2025-54988",
        "evidence": "CVE - CVE-2025-54988 (initial report)"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "Severity High"
  },
  "source_id": "official-apache-solr-security",
  "document_id": 22972,
  "published_at": "2025-12-09T00:00:00+00:00"
}