Search: CVE-2025-54988

CVE-2025-54988 is a high-severity XML External Entity (XXE) vulnerability in the Apache Tika PDF parser module affecting versions 1.13 through 3.2.1. It allows attackers to inject malicious XML entities via crafted XFA files inside PDFs, potentially enabling unauthorized reading of sensitive data or triggering malicious requests to internal or external resources. The vulnerability impacts multiple Tika packages that depend on the vulnerable PDF parser module. Users are advised to upgrade to Apache Tika version 3.2.2, which addresses this issue.