This Crucible Server and Fisheye Server release includes updates to our Apache Tika dependency in response to CVE-2025-66516.

Our security team has assessed that the current scope of this CVE does not present the same critical risk in our products, as our use of the dependency doesn’t support the known path for exploitation.

The patch for CVE-2025-66516 is being released out of an abundance of caution.{}

This Critical severity XXE (XML External Entity Injection) vulnerability was introduced in version 4.8.0 of Crucible Server and Fisheye Server.

This vulnerability, with a CVSS Score of 10, allows an unauthenticated attacker to exploit an undefinable vulnerability which has high impact to confidentiality, high impact to integrity, no impact to availability, and requires no user interaction.

Atlassian recommends that Crucible Server and Fisheye Server customers upgrade to latest version, if you are unable to do so, upgrade your instance to one of the specified supported fixed versions:

• Crucible Server and Fisheye Server 4.9: Upgrade to a release greater than or equal to 4.9.6

See the release notes (https://confluence.atlassian.com/crucible/crucible-releases-298977378.html, https://confluence.atlassian.com/fisheye/fisheye-releases-960155725.html). You can download the latest version of Crucible Server and Fisheye Server from the download center (https://www.atlassian.com/software/crucible/download-archives, https://www.atlassian.com/software/fisheye/download-archives).

The National Vulnerability Database provides the following description for this vulnerability: Critical XXE in Apache Tika tika-core (1.13-3.2.1), tika-pdf-module (2.0.0-3.2.1) and tika-parsers (1.13-1.28.5) modules on all platforms allows an attacker to carry out XML External Entity injection via a crafted XFA file inside of a PDF. This CVE covers the same vulnerability as in CVE-2025-54988. However, this CVE expands the scope of affected packages in two ways. First, while the entrypoint for the vulnerability was the tika-parser-pdf-module as reported in CVE-2025-54988, the vulnerability and its fix were in tika-core. Users who upgraded the tika-parser-pdf-module but did not upgrade tika-core to >= 3.2.2 would still be vulnerable. Second, the original report failed to mention that in the 1.x Tika releases, the PDFParser was in the "org.apache.tika:tika-parsers" module.