602 matches found
CVE-2025-66516-Writeup-POC
CVE-2025-66516: Critical XXE Vulnerability in Apache Tika Executive Summary CVE-2025-66516 is a critical XML External Entity XXE injection vulnerability in Apache Tika with a CVSS score of 10.0 maximum severity. The vulnerability allows remote attackers to read arbitrary files, perform Server-Sid...
Apache Tika - XXE Injection
Apache Tika versions 1.13 through 3.2.1 are vulnerable to XXE via malicious XFA in PDFs, allowing file read and SSRF attacks. id: CVE-2025-54988 info: name: Apache Tika - XXE Injection author: tx1ee severity: critical description: | Apache Tika versions 1.13 through 3.2.1 are vulnerable to XXE vi...
cve-2018-1335
Ankara Yildirim Beyazit University Computer Engineering Department CENG 325 - Principles of Information Security And Privacy CENG201 OOP Project Group Members @canumay @aslihann @ezgigucuyener @mburakdonmez References NVD - CVE-2018-1335 Exploit DB - Apache Tika-server 1.18 - Command Injection...
CVE-2018-11761
Summary In a recent research on Apache Tika, I found a DOS Denial of Service vulnerability existed on its XML parser. It is caused that the parser improperly parses XML document. Affected Version Tested on ElasticSearch 6.3.1 using Tika 1.18 and 6.2.3 using Tika 1.17 Analysis As we know, the core...
java-cve-2021-29425-tika-xxe
java-cve-2021-29425-tika-xxe...
CVE-2025-66516-POC
⚠️ READ DISCLAIMER BEFORE USE ⚠️ Educational/Authorized Testing Only | License | Security Policy About This POC This repository contains a proof-of-concept POC exploit for CVE-2025-66516 , an XML External Entity XXE injection vulnerability in Apache Tika versions prior to 3.2.2. The vulnerability...
DeepPass
DeepPass Dockerized application that analyzes documents for password candidates. The blogpost "DeepPass — Finding Passwords With Deep Learning" gives more detail on the approach and development of the model. To run: docker-compose up This will expose http://localhost:5000 where documents can be...
CVE-2018-1335
CVE-2018-1335 RCE vulnerability remote code execution on servers apache Tika-server with versions lower than 1.18 commands: sudo bash install.sh python2 exploit.py...
Tika-CVE-2025-66516-Lab
CVE-2025-66516 Minimal Verification Environment This project is used to verify CVE-2025-66516 XML External Entity Injection Vulnerability in Apache Tika. Vulnerability Description Apache Tika 3.2.1 and earlier versions, when parsing PDF files containing XFA forms, did not properly disable externa...
cve-2025-54988-VulnTikaProject
Apache Tika Vulnerability Testing Project This is a Spring Boot application that uses Apache Tika 3.2.1 for document processing and text extraction. Prerequisites Have Docker Usage ./start-app.sh or docker compose up -d CVE execution Upload your malicious PDF...
Apache Tika - XML External Entity Injection
Apache Tika tika-core 1.13-3.2.1, tika-pdf-module 2.0.0-3.2.1, and tika-parsers 1.13-1.28.5 contain an XML External Entity injection caused by processing crafted XFA files inside PDFs, letting attackers perform XXE attacks remotely, exploit requires crafted PDF input. id: CVE-2025-66516 info: nam...
Apache Tika < 1.1.8 - Header Command Injection
Apache Tika versions 1.7 to 1.17 allow clients to send carefully crafted headers to tika-server that could be used to inject commands into the command line of the server running tika-server. This vulnerability only affects those running tika-server on a server that is open to untrusted clients. i...
CLEANSTART-2026-TY92460 Critical XXE in Apache Tika tika-core (1
Security vulnerability affects the apache-nifi package. Critical XXE in Apache Tika tika-core 1...
CVE-2026-68494 vulnerabilities
Vulnerabilities for packages: keycloak, flyway, infinispan, apache-nifi, spark, scala, logstash, cass-config-builder, tez, dependency-track, apache-nifi-registry, apicurio-registry, trino, sonarqube, gradle, strimzi-kafka-operator, wildfly, opensearch, akhq, apache-tika, keycloak-config-cli,...
GHSA-642R-3GJ9-2PJ5 vulnerabilities
Vulnerabilities for packages: keycloak, flyway, infinispan, apache-nifi, spark, scala, logstash, cass-config-builder, tez, dependency-track, apache-nifi-registry, apicurio-registry, trino, sonarqube, gradle, strimzi-kafka-operator, wildfly, opensearch, akhq, apache-tika, keycloak-config-cli,...
Blackash-CVE-2025-66516
🚨 CVE-2025-66516 — Critical Apache Tika Vulnerability CVSS: 10.0 | Exploit Type: XXE Injection | Risk Level: MAXIMUM 🎯 Executive Summary CVE-2025-66516 is a critical XML External Entity XXE vulnerability in Apache Tika’s core processing engine. A single malicious PDF with XFA content can trigger:...
CLEANSTART-2026-HF44570 Critical XXE in Apache Tika tika-core (1
Security vulnerability affects the apache-nifi package. Critical XXE in Apache Tika tika-core 1...
Alternate Path Bypass
Apache Tika is vulnerable to an alternate path bypass. The vulnerability is due to improper protection of an alternate path, where the library does not properly validate alternate file paths and attackers can supply crafted paths to access unauthorized resources...
CLEANSTART-2026-SC57620 Relative Path Traversal in the ISA-Tab parser in Apache Software Foundation Apache Tika from 1
Security vulnerability affects the elasticsearch package. Relative Path Traversal in the ISA-Tab parser in Apache Software Foundation Apache Tika from 1...
