CVE-2025-66516 vulnerability reported in crx2oak 1.22.0 for AEM 6.5
This article explains a security vulnerability finding reported in the crx2oak 1.22.0 utility because it includes a vulnerable version of the org.apache.tika:tika-core library. The article describes the scope of the issue and the recommended mitigation options.
Description description
Environment
- Product: Adobe Experience Manager (AEM) 6.5.23 (on-premises)
- Instance: crx2oak 1.22.0 utility
Issue/Symptoms
A security scanner has identified that the crx2oak utility (version 1.22.0) includes the org.apache.tika:tika-core library version 1.27, which is vulnerable to CVE-2025-66516. The scanner reports the following finding:
- The library
org.apache.tika:tika-coreversion 1.27 was detected in the Maven library manager located inside the crx2oak.jar package on the AEM host and is vulnerable to CVE-2025-66516, which exists in versions>= 1.13,<= 3.2.1 - The vulnerability is flagged in the context of maintenance utilities used for AEM instance management.
- The
crx2oaktool is used for content synchronization and migration tasks, used during migration and maintenance activities. - The issue does not affect the AEM runtime itself but is specific to the offline administrative tool.
Cause
The crx2oak utility includes a version of the tika-core library that is affected by CVE-2025-66516. This issue does not impact the AEM runtime if the official Tika hotfix is applied. However, the utility itself continues to use the older library until an updated version is released.
Resolution resolution
Follow the workaround below
-
Understand the scope
- The CVE-2025-66516 vulnerability is present in the
tika-corelibrary bundled withcrx2oak1.22.0, an offline migration tool for AEM. - This issue does not impact the AEM runtime if the official Tika hotfix (
cq-6.5.0-hotfix-GRANITE-63488-SP21-1.4.zip) is installed, as that hotfix updates the Tika OSGi bundles used by AEM itself.
- The CVE-2025-66516 vulnerability is present in the
-
If the concern is for the AEM runtime, apply the official Tika hotfix as described in AEM documentation. Note: Both
crx2oakandoak-runare maintenance utilities, not part of the AEM runtime, and are intended for use by administrators during maintenance windows. These tools are not network-exposed and should be treated as offline utilities. -
Requesting an updated crx2oak version
- To request a new version with updated libraries, submit an enhancement or support request to Adobe.
- For
oak-run, which is maintained by the Apache Jackrabbit Oak project, submit requests for updated dependencies through an Apache Jackrabbit JIRA issue.
Note: Limit the use of crx2oak and oak-run to trusted administrative environments. Do not expose these tools to untrusted networks or users.
The crx2oak utility includes a version of the tika-core library that is affected by CVE-2025-66516. This does not impact the AEM runtime if the official Tika hotfix is applied, but the utility itself remains on the older library until an updated version is released.