A critical XML External Entity (XXE) vulnerability exists in Apache Tika's tika-parser-pdf-module versions 1.13 through 3.2.1. This flaw allows attackers to exploit crafted XFA files inside PDFs to perform XXE injection, potentially leading to sensitive data disclosure or malicious requests to internal or external servers. The vulnerability affects multiple Tika packages that depend on this module. Upgrading to version 3.2.2 or 2.0.0-ALPHA resolves the issue.