Apache Tika's PDF Parser Followed an XFA Reference Out of the Document

An uploaded PDF carried an XFA reference the parser was willing to resolve. What CVE-2025-66516 exposes about file-extraction trust boundaries, and why containing the parser matters more than watching it.