Apache-Tika

Apache Tika PDF Parser XXE via Crafted XFA Form (CVE-2025-54988)

Apache Tika's PDF parser processes an embedded XFA (XML Forms Architecture) form's XML content with external entity resolution enabled. A crafted PDF whose AcroForm dictionary contains an /XFA key pointing to a stream object holding malicious XFA XML can…