CVE-2018-11762

MEDIUM

Apache Tika < 1.18 - Path Traversal

Title source: rule

Description

In Apache Tika 0.9 to 1.18, in a rare edge case where a user does not specify an extract directory on the commandline (--extract-dir=) and the input file has an embedded file with an absolute path, such as "C:/evil.bat", tika-app would overwrite that file.

Exploits (2)

References (2)

Scores

CVSS v3 5.9
EPSS 0.0087
EPSS Percentile 75.2%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Details

CWE
CWE-22
Status published
Products (2)
apache/tika 0.9 - 1.18
org.apache.tika/tika-core 0.9 - 1.19Maven
Published Sep 19, 2018
Tracked Since Feb 18, 2026