CVE-2018-11762

CVE-2018-11762: vulnerability in Apache Tika

Published · Updated

Follow this CVE+ Monitor Apache Tika+ Monitor tika

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

3Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackepss 5.4%
In Apache Tika 0.9 to 1.18, in a rare edge case where a user does not specify an extract directory on the commandline (--extract-dir=) and the input file has an embedded file with an absolute path, such as "C:/evil.bat", tika-app would overwrite that file.
Affected products
Apache Software Foundation · Apache Tika
Related CVEs — Apache Tika

In the same product, most dangerous first.

CVE-2018-1335—CVE-2018-1335EPSS 93.6%CVE-2018-11761—CVE-2018-11761EPSS 9.4%CVE-2018-11796—CVE-2018-11796EPSS 7.5%CVE-2018-17197—CVE-2018-17197EPSS 6.1%CVE-2021-28657—Infinite loop in Apache Tika's MP3 parserEPSS 2.7%CVE-2022-30126—Apache Tika Regular Expression Denial of Service in Standards ExtractorEPSS 2.6%