Not rated
CVE-2018-11762 In Apache Tika 0.9 to 1.18, in a rare edge case where a user does not specify an extract directory on the commandline…
Description
In Apache Tika 0.9 to 1.18, in a rare edge case where a user does not specify an extract directory on the commandline (--extract-dir=) and the input file has an embedded file with an absolute path, such as "C:/evil.bat", tika-app would overwrite that file.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Apache Tika | Versions not published |
References
- 105515 www.securityfocus.com
- [tika-dev] 20180919 [CVE-2018-11762] Zip Slip Vulnerability in Apache Tika's tika-app lists.apache.org
Timeline
- Published
- Last modified
Other CVEs of Apache Tika
The 15 CVEs of Apache Tika →
CVE-2026-66756
Improper Protection of Alternate Path vulnerability in Apache Tika
6.9
Medium
CVE-2026-66755
Relative Path Traversal in the ISA-Tab parser in Apache Software Foundation Apache Tika from 1.8 through 3.3.1, and…
5.9
Medium
CVE-2022-33879
The initial fixes in CVE-2022-30126 and CVE-2022-30973 for regexes in the StandardsExtractingContentHandler were…
Not rated
CVE-2022-30973
We failed to apply the fix for CVE-2022-30126 to the 1.x branch in the 1.28.2 release
Not rated