Not rated
CVE-2018-1335 From Apache Tika versions 1.7 to 1.17, clients could send carefully crafted headers to tika-server that could be used to…
Description
From Apache Tika versions 1.7 to 1.17, clients could send carefully crafted headers to tika-server that could be used to inject commands into the command line of the server running tika-server. This vulnerability only affects those running tika-server on a server that is open to untrusted clients. The mitigation is to upgrade to Tika 1.18.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Apache Tika | Versions not published |
References
- [dev] 20180425 [CVE-2018-1335] Command Injection Vulnerability in Apache Tika's tika-server module lists.apache.org
- 104001 www.securityfocus.com
- 46540 www.exploit-db.com
- packetstormsecurity.com packetstormsecurity.com
- RHSA-2019:3140 access.redhat.com
Timeline
- Published
- Last modified
Other CVEs of Apache Tika
The 15 CVEs of Apache Tika →
CVE-2026-66756
Improper Protection of Alternate Path vulnerability in Apache Tika
6.9
Medium
CVE-2026-66755
Relative Path Traversal in the ISA-Tab parser in Apache Software Foundation Apache Tika from 1.8 through 3.3.1, and…
5.9
Medium
CVE-2022-33879
The initial fixes in CVE-2022-30126 and CVE-2022-30973 for regexes in the StandardsExtractingContentHandler were…
Not rated
CVE-2022-30973
We failed to apply the fix for CVE-2022-30126 to the 1.x branch in the 1.28.2 release
Not rated