CVE-2025-54988

CVE-2025-54988 is a critical XML External Entity (XXE) vulnerability found in Apache Tika's PDF parser module (tika-parser-pdf-module). It affects Apache Tika versions 1.13 through 3.2.1. The vulnerability exists in how the PDFParser handles XML Forms Architecture (XFA) content within PDF documents. An attacker can exploit this vulnerability by crafting a malicious XFA file embedded within a PDF document. This allows for XML External Entity injection attacks, potentially enabling the attacker to read sensitive files from the target system, access internal network resources, or trigger requests to external servers. The vulnerability affects multiple Tika packages including tika-parsers-standard-modules, tika-parsers-standard-package, tika-app, tika-grpc, and tika-server-standard. Users are recommended to upgrade to version 3.2.2, which fixes this issue.