StackRadar

CVE-2025-66516

Critical

Advisory

Published 4 Dec 2025In the index since 6 Sept 2026
Severity
Critical
worst across findings
CVSS
10.0
base score, highest
EPSS
0.877
100th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
44
of 17,781 indexed, latest versions
Container images
39
deployed by those charts
Fix available
3 of 3
affected packages

Apache Tika has XXE vulnerability

Carried by container images the latest versions of 44 of 17,781 indexed charts deploy, on 39 images.

Affected packageAffected versionsFixed inImages
tika-coremaven1.14, 1.16, 1.18, 1.22+17 more3.2.239
tika-parsersmaven1.14, 1.16, 1.22, 1.24+4 more2.0.010
tika-parser-pdf-modulemaven2.7.0, 2.9.0, 2.9.2, 2.9.33.2.29
OSV records
GHSA-f58c-gq56-vjjf

Charts affected

44 by stars
ChartLatestAffected imagesRadar Score
solrpreferred-aiVerified publisher3.2.01 of 3See more

solr preferred-ai 3.2.0

1 of the 3 container images this version deploys carry CVE-2025-66516.

Container imageDigestPackageFixed in
library/solr:8.7.0d124efd81fbb
tika-core@1.24.1
tika-parsers@1.24.1
3.2.2
2.0.0

Open the chart page →

6,048
janssenjanssen-auth-serverOfficialVerified publisher0.0.0-nightly1 of 8See more

janssen janssen-auth-server 0.0.0-nightly

1 of the 8 container images this version deploys carry CVE-2025-66516.

Container imageDigestPackageFixed in
ghcr.io/janssenproject/jans/config-api:0.0.0-nightly900e2b88bd08
tika-core@2.9.2
3.2.2

Open the chart page →

1,068
jira-softwaremoxVerified publisher2.7.11 of 3See more

jira-software mox 2.7.1

1 of the 3 container images this version deploys carry CVE-2025-66516.

Container imageDigestPackageFixed in
atlassian/jira-software:9.7.264a75aa4ec4e
tika-core@1.22
3.2.2

Open the chart page →

8,636
thehivestrangebee-helmOfficialVerified publisher1.0.61 of 7See more

thehive strangebee-helm 1.0.6

1 of the 7 container images this version deploys carry CVE-2025-66516.

Container imageDigestPackageFixed in
bitnamilegacy/elasticsearch:9.1.2-debian-12-r000176a47afa0
tika-core@2.9.3
tika-parser-pdf-module@2.9.3
3.2.2
3.2.2

Open the chart page →

16,210
seafiledatamateVerified publisher0.6.01 of 6See more

seafile datamate 0.6.0

1 of the 6 container images this version deploys carry CVE-2025-66516.

Container imageDigestPackageFixed in
bitnamilegacy/elasticsearch:8.12.1-debian-11-r29cfd2df1294d
tika-core@2.7.0
tika-parser-pdf-module@2.7.0
3.2.2
3.2.2

Open the chart page →

27,267
repoflowrepoflow-helm-public0.9.11 of 8See more

repoflow repoflow-helm-public 0.9.1

1 of the 8 container images this version deploys carry CVE-2025-66516.

Container imageDigestPackageFixed in
library/elasticsearch:8.15.0310b9fc03b06
tika-core@2.9.2
tika-parser-pdf-module@2.9.2
3.2.2
3.2.2

Open the chart page →

13,521
feedbacksystemthm-mni-iiVerified publisher0.47.11 of 10See more

feedbacksystem thm-mni-ii 0.47.1

1 of the 10 container images this version deploys carry CVE-2025-66516.

Container imageDigestPackageFixed in
thmmniii/fbs-core:v1.27.15438517d9fc2
tika-core@2.8.0
3.2.2

Open the chart page →

28,534
paperless-ngxadnoctemVerified publisher0.4.21 of 5See more

paperless-ngx adnoctem 0.4.2

1 of the 5 container images this version deploys carry CVE-2025-66516.

Container imageDigestPackageFixed in
apache/tika:2.9.0.092d055a84e9e
tika-core@2.9.0
tika-parser-pdf-module@2.9.0
3.2.2
3.2.2

Open the chart page →

19,691
distributed-jmetercloudnativeapp1.0.11 of 1See more

distributed-jmeter cloudnativeapp 1.0.1

1 of the 1 container images this version deploys carry CVE-2025-66516.

Container imageDigestPackageFixed in
pedrocesarti/jmeter-docker:3.314851f144f57
tika-core@1.16
tika-parsers@1.16
3.2.2
2.0.0

Open the chart page →

4,532
data-fairdata354-helmVerified publisher1.1.21 of 12See more

data-fair data354-helm 1.1.2

1 of the 12 container images this version deploys carry CVE-2025-66516.

Container imageDigestPackageFixed in
ghcr.io/data-fair/elasticsearch:7.17.1aa45adaf59a7
tika-core@1.27
tika-parsers@1.27
3.2.2
2.0.0

Open the chart page →

38,346
zammaddevplayer0Verified publisher4.0.51 of 4See more

zammad devplayer0 4.0.5

1 of the 4 container images this version deploys carry CVE-2025-66516.

Container imageDigestPackageFixed in
zammad/zammad-docker-compose:zammad-elasticsearch-4.1.0-318274d75a51fc
tika-core@1.24
tika-parsers@1.24
3.2.2
2.0.0

Open the chart page →

6,110
gluugluu-flexOfficialVerified publisher0.0.0-nightly1 of 9See more

gluu gluu-flex 0.0.0-nightly

1 of the 9 container images this version deploys carry CVE-2025-66516.

Container imageDigestPackageFixed in
ghcr.io/janssenproject/jans/config-api:0.0.0-nightly900e2b88bd08
tika-core@2.9.2
3.2.2

Open the chart page →

1,507
jmeterjmeterVerified publisher1.2.51 of 1See more

jmeter jmeter 1.2.5

1 of the 1 container images this version deploys carry CVE-2025-66516.

Container imageDigestPackageFixed in
liukunup/jmeter:5.59c079617a81b
tika-core@1.28.4
tika-parsers@1.28.4
3.2.2
2.0.0

Open the chart page →

2,067
clowder2ncsaVerified publisher1.9.71 of 12See more

clowder2 ncsa 1.9.7

1 of the 12 container images this version deploys carry CVE-2025-66516.

Container imageDigestPackageFixed in
bitnamilegacy/elasticsearch:8.12.215d4647fd491
tika-core@2.7.0
tika-parser-pdf-module@2.7.0
3.2.2
3.2.2

Open the chart page →

37,373
ckanstatcan0.0.351 of 8See more

ckan statcan 0.0.35

1 of the 8 container images this version deploys carry CVE-2025-66516.

Container imageDigestPackageFixed in
library/solr:8.11.18c5f7881cebb
tika-core@1.27
tika-parsers@1.27
3.2.2
2.0.0

Open the chart page →

24,930
arlas-aiasarlas-stackVerified publisher28.8.01 of 22See more

arlas-aias arlas-stack 28.8.0

1 of the 22 container images this version deploys carry CVE-2025-66516.

Container imageDigestPackageFixed in
bitnamilegacy/elasticsearch:9.0.1-debian-12-r0e6f6ddcce2f1
tika-core@2.9.3
tika-parser-pdf-module@2.9.3
3.2.2
3.2.2

Open the chart page →

40,238
metabasecasemark2.16.111 of 1See more

metabase casemark 2.16.11

1 of the 1 container images this version deploys carry CVE-2025-66516.

Container imageDigestPackageFixed in
cmosborn/metabase-arm64:0.50.286ec0a8878ad2
tika-core@2.9.2
3.2.2

Open the chart page →

1,215
fineractfineract-openshift0.1.11 of 4See more

fineract fineract-openshift 0.1.1

1 of the 4 container images this version deploys carry CVE-2025-66516.

Container imageDigestPackageFixed in
apache/fineract:1.12.1a83cf1980609
tika-core@2.9.3
3.2.2

Open the chart page →

7,792
komgageek-cookbookVerified publisher2.4.21 of 1See more

komga geek-cookbook 2.4.2

1 of the 1 container images this version deploys carry CVE-2025-66516.

Container imageDigestPackageFixed in
gotson/komga:0.99.49b15ea6bfc30
tika-core@1.26
3.2.2

Open the chart page →

12,581
sharrygeek-cookbookVerified publisher5.4.21 of 1See more

sharry geek-cookbook 5.4.2

1 of the 1 container images this version deploys carry CVE-2025-66516.

Container imageDigestPackageFixed in
eikek0/sharry:1.8.0661ff3ef42cd
tika-core@1.26
3.2.2

Open the chart page →

1,419
video-analytics-demogpu-operator0.1.91 of 3See more

video-analytics-demo gpu-operator 0.1.9

1 of the 3 container images this version deploys carry CVE-2025-66516.

Container imageDigestPackageFixed in
anguda/ant-media:2.5c435285fc241
tika-core@1.22
tika-parsers@1.22
3.2.2
2.0.0

Open the chart page →

15,722
ckanhelmforgeVerified publisher1.3.81 of 6See more

ckan helmforge 1.3.8

1 of the 6 container images this version deploys carry CVE-2025-66516.

Container imageDigestPackageFixed in
ckan/ckan-solr:2.11-solr9ef8e5d3e6be1
tika-core@1.28.5
tika-parsers@1.28.5
3.2.2
2.0.0

Open the chart page →

9,920
ibm-kerify-devibm-charts1.0.01 of 1See more

ibm-kerify-dev ibm-charts 1.0.0

1 of the 1 container images this version deploys carry CVE-2025-66516.

Container imageDigestPackageFixed in
ibmcom/icp-sert-bats:3.2.0b558f2b444ae
tika-core@1.18
3.2.2

Open the chart page →

8,221
ibm-microclimateibm-charts0.1.01 of 8See more

ibm-microclimate ibm-charts 0.1.0

1 of the 8 container images this version deploys carry CVE-2025-66516.

Container imageDigestPackageFixed in
ibmcom/microclimate-portal:latested5505e5c7ec
tika-core@1.16
tika-parsers@1.16
3.2.2
2.0.0

Open the chart page →

57,669
daveit-at-mOfficialVerified publisher0.2.151 of 11See more

dave it-at-m 0.2.15

1 of the 11 container images this version deploys carry CVE-2025-66516.

Container imageDigestPackageFixed in
bitnamilegacy/elasticsearch:9.1.2-debian-12-r000176a47afa0
tika-core@2.9.3
tika-parser-pdf-module@2.9.3
3.2.2
3.2.2

Open the chart page →

15,089
opencloudjacobcolvinVerified publisher0.2.31 of 13See more

opencloud jacobcolvin 0.2.3

1 of the 13 container images this version deploys carry CVE-2025-66516.

Container imageDigestPackageFixed in
apache/tika:2.9.2.1-fullae0b86d3c4d0
tika-core@2.9.2
tika-parser-pdf-module@2.9.2
3.2.2
3.2.2

Open the chart page →

45,239
nexusjenkins-x0.1.371 of 1See more

nexus jenkins-x 0.1.37

1 of the 1 container images this version deploys carry CVE-2025-66516.

Container imageDigestPackageFixed in
ghcr.io/jenkins-x/nexus:0.1.378caf5289fe73
tika-core@1.24.1
3.2.2

Open the chart page →

12,856
allurekfirfer0.1.81 of 2See more

allure kfirfer 0.1.8

1 of the 2 container images this version deploys carry CVE-2025-66516.

Container imageDigestPackageFixed in
frankescobar/allure-docker-service:2.21.08a4d7e9308de
tika-core@2.6.0
3.2.2

Open the chart page →

12,527
komgalinkding0.2.31 of 1See more

komga linkding 0.2.3

1 of the 1 container images this version deploys carry CVE-2025-66516.

Container imageDigestPackageFixed in
gotson/komga:1.22.0ba892ab3e082
tika-core@2.9.1
3.2.2

Open the chart page →

3,131
metabase-k8smetabase-k8s1.0.01 of 1See more

metabase-k8s metabase-k8s 1.0.0

1 of the 1 container images this version deploys carry CVE-2025-66516.

Container imageDigestPackageFixed in
metabase/metabase:v0.53.4.17807bc5cad17
tika-core@3.0.0
3.2.2

Open the chart page →

2,589
elasticmicroboxlabs0.3.01 of 1See more

elastic microboxlabs 0.3.0

1 of the 1 container images this version deploys carry CVE-2025-66516.

Container imageDigestPackageFixed in
library/elasticsearch:8.17.32cc40b15dff8
tika-core@2.9.2
tika-parser-pdf-module@2.9.2
3.2.2
3.2.2

Open the chart page →

4,257
resource-processormicroservices-learningVerified publisher1.2.01 of 1See more

resource-processor microservices-learning 1.2.0

1 of the 1 container images this version deploys carry CVE-2025-66516.

Container imageDigestPackageFixed in
maksimkavalenka/microservices-learning.resource-processor:latest64a25afb8748
tika-core@2.9.0
tika-parser-pdf-module@2.9.0
3.2.2
3.2.2

Open the chart page →

3,683
alluremidokura-communityVerified publisher0.1.31 of 2See more

allure midokura-community 0.1.3

1 of the 2 container images this version deploys carry CVE-2025-66516.

Container imageDigestPackageFixed in
frankescobar/allure-docker-service:2.19.0cafa03b94dac
tika-core@2.4.1
3.2.2

Open the chart page →

12,847
crowdmoxVerified publisher2.4.31 of 3See more

crowd mox 2.4.3

1 of the 3 container images this version deploys carry CVE-2025-66516.

Container imageDigestPackageFixed in
atlassian/crowd:5.2.2ebf761c7d437
tika-core@2.7.0
3.2.2

Open the chart page →

5,663
onedevonedev11.9.01 of 1See more

onedev onedev 11.9.0

1 of the 1 container images this version deploys carry CVE-2025-66516.

Container imageDigestPackageFixed in
1dev/server:11.9.0cd5b12fe5471
tika-core@1.28.3
3.2.2

Open the chart page →

6,037
cdn-remoteopencord0.2.41 of 3See more

cdn-remote opencord 0.2.4

1 of the 3 container images this version deploys carry CVE-2025-66516.

Container imageDigestPackageFixed in
omecproject/cdn-antmedia:1.0.0b4ae7d0d6b74
tika-core@1.14
tika-parsers@1.14
3.2.2
2.0.0

Open the chart page →

63,223
fineractopenshift0.1.11 of 4See more

fineract openshift 0.1.1

1 of the 4 container images this version deploys carry CVE-2025-66516.

Container imageDigestPackageFixed in
apache/fineract:1.12.1a83cf1980609
tika-core@2.9.3
3.2.2

Open the chart page →

7,792
reportportalreportportal5.7.22 of 8See more

reportportal reportportal 5.7.2

2 of the 8 container images this version deploys carry CVE-2025-66516.

Container imageDigestPackageFixed in
reportportal/service-api:5.7.29df41f8fb320
tika-core@1.24
3.2.2
reportportal/service-authorization:5.7.09e73114dbd15
tika-core@1.24
3.2.2

Open the chart page →

25,737
sonatype-nexus3simcube1.0.11 of 2See more

sonatype-nexus3 simcube 1.0.1

1 of the 2 container images this version deploys carry CVE-2025-66516.

Container imageDigestPackageFixed in
sonatype/nexus3:3.58.1586060431b64
tika-core@1.28.4
3.2.2

Open the chart page →

4,946
atlassian-confluencesomeblackmagic3.4.11 of 1See more

atlassian-confluence someblackmagic 3.4.1

1 of the 1 container images this version deploys carry CVE-2025-66516.

Container imageDigestPackageFixed in
atlassian/confluence-server:7.10.03b9222ab32ef
tika-core@1.23
3.2.2

Open the chart page →

13,605
atlassian-jirasomeblackmagic3.3.21 of 1See more

atlassian-jira someblackmagic 3.3.2

1 of the 1 container images this version deploys carry CVE-2025-66516.

Container imageDigestPackageFixed in
atlassian/jira-software:8.14.037bc46cbec1a
tika-core@1.22
3.2.2

Open the chart page →

13,079
fdi-dotstatsuite-sfs-solrstatcan1.0.21 of 4See more

fdi-dotstatsuite-sfs-solr statcan 1.0.2

1 of the 4 container images this version deploys carry CVE-2025-66516.

Container imageDigestPackageFixed in
library/solr:8.11.18c5f7881cebb
tika-core@1.27
tika-parsers@1.27
3.2.2
2.0.0

Open the chart page →

6,065
solrstatcan1.5.101 of 3See more

solr statcan 1.5.10

1 of the 3 container images this version deploys carry CVE-2025-66516.

Container imageDigestPackageFixed in
library/solr:8.11.18c5f7881cebb
tika-core@1.27
tika-parsers@1.27
3.2.2
2.0.0

Open the chart page →

8,806
opencloudunxwaresVerified publisher0.2.31 of 13See more

opencloud unxwares 0.2.3

1 of the 13 container images this version deploys carry CVE-2025-66516.

Container imageDigestPackageFixed in
apache/tika:2.9.2.1-fullae0b86d3c4d0
tika-core@2.9.2
tika-parser-pdf-module@2.9.2
3.2.2
3.2.2

Open the chart page →

45,239

Container images carrying it

39 by charts deploying them

A fixed version is listed for 3 of the 3 affected packages.

Container imageDigestPackageFixed inUsed by
library/solr:8.11.18c5f7881cebb
tika-core@1.27
tika-parsers@1.27
3.2.2
2.0.0
3
apache/fineract:1.12.1a83cf1980609
tika-core@2.9.3
3.2.2
2
apache/tika:2.9.2.1-fullae0b86d3c4d0
tika-core@2.9.2
tika-parser-pdf-module@2.9.2
3.2.2
3.2.2
2
bitnamilegacy/elasticsearch:9.1.2-debian-12-r000176a47afa0
tika-core@2.9.3
tika-parser-pdf-module@2.9.3
3.2.2
3.2.2
2
ghcr.io/janssenproject/jans/config-api:0.0.0-nightly900e2b88bd08
tika-core@2.9.2
3.2.2
2
1dev/server:11.9.0cd5b12fe5471
tika-core@1.28.3
3.2.2
1
anguda/ant-media:2.5c435285fc241
tika-core@1.22
tika-parsers@1.22
3.2.2
2.0.0
1
apache/tika:2.9.0.092d055a84e9e
tika-core@2.9.0
tika-parser-pdf-module@2.9.0
3.2.2
3.2.2
1
atlassian/confluence-server:7.10.03b9222ab32ef
tika-core@1.23
3.2.2
1
atlassian/crowd:5.2.2ebf761c7d437
tika-core@2.7.0
3.2.2
1
atlassian/jira-software:8.14.037bc46cbec1a
tika-core@1.22
3.2.2
1
atlassian/jira-software:9.7.264a75aa4ec4e
tika-core@1.22
3.2.2
1
bitnamilegacy/elasticsearch:8.12.215d4647fd491
tika-core@2.7.0
tika-parser-pdf-module@2.7.0
3.2.2
3.2.2
1
bitnamilegacy/elasticsearch:8.12.1-debian-11-r29cfd2df1294d
tika-core@2.7.0
tika-parser-pdf-module@2.7.0
3.2.2
3.2.2
1
bitnamilegacy/elasticsearch:9.0.1-debian-12-r0e6f6ddcce2f1
tika-core@2.9.3
tika-parser-pdf-module@2.9.3
3.2.2
3.2.2
1
ckan/ckan-solr:2.11-solr9ef8e5d3e6be1
tika-core@1.28.5
tika-parsers@1.28.5
3.2.2
2.0.0
1
cmosborn/metabase-arm64:0.50.286ec0a8878ad2
tika-core@2.9.2
3.2.2
1
eikek0/sharry:1.8.0661ff3ef42cd
tika-core@1.26
3.2.2
1
frankescobar/allure-docker-service:2.21.08a4d7e9308de
tika-core@2.6.0
3.2.2
1
frankescobar/allure-docker-service:2.19.0cafa03b94dac
tika-core@2.4.1
3.2.2
1
gotson/komga:0.99.49b15ea6bfc30
tika-core@1.26
3.2.2
1
gotson/komga:1.22.0ba892ab3e082
tika-core@2.9.1
3.2.2
1
ibmcom/icp-sert-bats:3.2.0b558f2b444ae
tika-core@1.18
3.2.2
1
ibmcom/microclimate-portal:latested5505e5c7ec
tika-core@1.16
tika-parsers@1.16
3.2.2
2.0.0
1
library/elasticsearch:8.17.32cc40b15dff8
tika-core@2.9.2
tika-parser-pdf-module@2.9.2
3.2.2
3.2.2
1
library/elasticsearch:8.15.0310b9fc03b06
tika-core@2.9.2
tika-parser-pdf-module@2.9.2
3.2.2
3.2.2
1
library/solr:8.7.0d124efd81fbb
tika-core@1.24.1
tika-parsers@1.24.1
3.2.2
2.0.0
1
liukunup/jmeter:5.59c079617a81b
tika-core@1.28.4
tika-parsers@1.28.4
3.2.2
2.0.0
1
maksimkavalenka/microservices-learning.resource-processor:latest64a25afb8748
tika-core@2.9.0
tika-parser-pdf-module@2.9.0
3.2.2
3.2.2
1
metabase/metabase:v0.53.4.17807bc5cad17
tika-core@3.0.0
3.2.2
1
omecproject/cdn-antmedia:1.0.0b4ae7d0d6b74
tika-core@1.14
tika-parsers@1.14
3.2.2
2.0.0
1
pedrocesarti/jmeter-docker:3.314851f144f57
tika-core@1.16
tika-parsers@1.16
3.2.2
2.0.0
1
reportportal/service-api:5.7.29df41f8fb320
tika-core@1.24
3.2.2
1
reportportal/service-authorization:5.7.09e73114dbd15
tika-core@1.24
3.2.2
1
sonatype/nexus3:3.58.1586060431b64
tika-core@1.28.4
3.2.2
1
thmmniii/fbs-core:v1.27.15438517d9fc2
tika-core@2.8.0
3.2.2
1
zammad/zammad-docker-compose:zammad-elasticsearch-4.1.0-318274d75a51fc
tika-core@1.24
tika-parsers@1.24
3.2.2
2.0.0
1
ghcr.io/data-fair/elasticsearch:7.17.1aa45adaf59a7
tika-core@1.27
tika-parsers@1.27
3.2.2
2.0.0
1
ghcr.io/jenkins-x/nexus:0.1.378caf5289fe73
tika-core@1.24.1
3.2.2
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.