This vulnerability (CVE-2025-54988) involves improper restriction of XML External Entity references (CWE-611) in the Apache Tika PDF parser module. Versions 1.13 through 3.2.1 on all platforms are affected. An attacker can exploit this by crafting a malicious XFA file embedded within a PDF document to perform XXE injection. This can lead to disclosure of sensitive information or cause the system to make unauthorized requests to internal or third-party servers. The vulnerable module is included as a dependency in several Apache Tika packages such as tika-parsers-standard-modules, tika-parsers-standard-package, tika-app, tika-grpc, and tika-server-standard. The Apache Software Foundation has released version 3.2.2 to fix this vulnerability.

Successful exploitation of this vulnerability can result in high impact including confidentiality, integrity, and availability consequences. Attackers may read sensitive data from the affected system or cause it to send malicious requests to internal or external resources, potentially leading to data leakage or further attacks. The CVSS v3.1 base score is 8.4, indicating a high severity level with attack vector local, low attack complexity, no privileges required, no user interaction, and impacts to confidentiality, integrity, and availability.

A fix is available in Apache Tika version 3.2.2. Users and administrators should upgrade affected Apache Tika installations to version 3.2.2 or later to remediate this vulnerability. Since this is not a cloud service, remediation depends on applying the official patch. No additional vendor advisory content is provided, so check the Apache Software Foundation's official security advisories for the latest updates and guidance.