High severity · published Sep 30, 2017
CVE-2016-4434
Apache Tika before 1.13 does not properly initialize the XML parser or choose handlers, which might allow remote attackers to conduct XML External Entity (XXE) attacks via vectors…
7.8
CVSS
3.6%
EPSS
No
On KEV
Description
Apache Tika before 1.13 does not properly initialize the XML parser or choose handlers, which might allow remote attackers to conduct XML External Entity (XXE) attacks via vectors involving (1) spreadsheets in OOXML files and (2) XMP metadata in PDF and other file formats, a related issue to CVE-2016-2175.
CVSS vector
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)3.6% · higher than 89% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
TI
Tika · Apache
1.12 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2016-4434
CVE.org
https://www.cve.org/CVERecord?id=CVE-2016-4434
rhn.redhat.com
http://rhn.redhat.com/errata/RHSA-2017-0248.html
rhn.redhat.com
http://rhn.redhat.com/errata/RHSA-2017-0249.html
rhn.redhat.com
http://rhn.redhat.com/errata/RHSA-2017-0272.html
www.securityfocus.com
http://www.securityfocus.com/archive/1/538500/100/0/threaded
lists.apache.org
https://lists.apache.org/thread.html/708d94141126eac03011144a971a6411fcac16d9c248d1d535a39451%40%3Csolr-user.lucene.apache.org%3E
Mailing List
https://mail-archives.apache.org/mod_mbox/tika-dev/201605.mbox/%3C1705136517.1175366.1464278135251.JavaMail.yahoo%40mail.yahoo.com%3E
More from Tika
9.8
CVE-2026-66756
Apache Tika: unpack endpoint in tika-server allows configuration with unsecureFeatures=false
9.8
CVE-2025-66516
Critical XXE in Apache Tika tika-core (1.13-3.2.1), tika-pdf-module (2.0.0-3.2.1) and tika-parsers (1.13-1.28.5) modules on all platforms allows an attacker to carry out XML…
9.8
CVE-2016-6809
Apache Tika before 1.14 allows Java code execution for serialized objects embedded in MATLAB files
8.8
CVE-2019-10088
A carefully crafted or corrupt zip file can cause an OOM in Apache Tika's RecursiveParserWrapper in versions 1.7-1.21
8.4
CVE-2025-54988
Critical XXE in Apache Tika (tika-parser-pdf-module) in Apache Tika 1.13 through and including 3.2.1 on all platforms allows an attacker to carry out XML External Entity injection…