CVE-2025-54988
Apache Tika PDF parser module: XXE vulnerability in PDFParser's handling of XFA
Critical XXE in Apache Tika (tika-parser-pdf-module) in Apache Tika 1.13 through and including 3.2.1 on all platforms allows an attacker to carry out XML External Entity injection via a crafted XFA file inside of a PDF. An attacker may be able to read sensitive data or trigger malicious requests to internal resources or third-party servers. Note that the tika-parser-pdf-module is used as a dependency in several Tika packages including at least: tika-parsers-standard-modules, tika-parsers-standard-package, tika-app, tika-grpc and tika-server-standard. Users are recommended to upgrade to version 3.2.2, which fixes this issue.
| CWE | CWE-611 |
| Vendor | apache software foundation |
| Product | apache tika pdf parser module |
| Published | Aug 20, 2025 |
| Last Updated | Feb 26, 2026 |
Get instant alerts for apache software foundation apache tika pdf parser module
Be the first to know when new high vulnerabilities affecting apache software foundation apache tika pdf parser module are published — delivered to Slack, Telegram or Discord.
CVSS v3 Breakdown
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H