CVE-2018-11761

Summary In a recent research on Apache Tika, I found a DOS Denial of Service vulnerability existed on its XML parser. It is caused that the parser improperly parses XML document. Affected Version Tested on ElasticSearch 6.3.1 using Tika 1.18 and 6.2.3 using Tika 1.17 Analysis As we know, the core...

java-cve-2021-29425-tika-xxe

java-cve-2021-29425-tika-xxe...

cve-2018-1335

Ankara Yildirim Beyazit University Computer Engineering Department CENG 325 - Principles of Information Security And Privacy CENG201 OOP Project Group Members @canumay @aslihann @ezgigucuyener @mburakdonmez References NVD - CVE-2018-1335 Exploit DB - Apache Tika-server 1.18 - Command Injection...

CVE-2025-66516-Writeup-POC

CVE-2025-66516: Critical XXE Vulnerability in Apache Tika Executive Summary CVE-2025-66516 is a critical XML External Entity XXE injection vulnerability in Apache Tika with a CVSS score of 10.0 maximum severity. The vulnerability allows remote attackers to read arbitrary files, perform Server-Sid...

CVE-2025-66516-POC

⚠️ READ DISCLAIMER BEFORE USE ⚠️ Educational/Authorized Testing Only | License | Security Policy About This POC This repository contains a proof-of-concept POC exploit for CVE-2025-66516 , an XML External Entity XXE injection vulnerability in Apache Tika versions prior to 3.2.2. The vulnerability...

Apache Tika < 1.1.8 - Header Command Injection

Apache Tika versions 1.7 to 1.17 allow clients to send carefully crafted headers to tika-server that could be used to inject commands into the command line of the server running tika-server. This vulnerability only affects those running tika-server on a server that is open to untrusted clients. i...

DeepPass

DeepPass 문서에서 비밀번호 후보를 분석하는 Docker 기반 애플리케이션입니다. 블로그 게시글 "DeepPass — Finding Passwords With Deep Learning" 에 모델의 접근 방식과 개발에 대한 자세한 내용이 나와 있습니다. 실행 방법: docker-compose up 이렇게 하면 문서를 업로드할 수 있는 http://localhost:5000이 노출됩니다. API는 http://localhost:5000/api/passwords 에서 수동으로 사용할 수 있습니다:...

Apache Tika - XXE Injection

Apache Tika versions 1.13 through 3.2.1 are vulnerable to XXE via malicious XFA in PDFs, allowing file read and SSRF attacks. id: CVE-2025-54988 info: name: Apache Tika - XXE Injection author: tx1ee severity: critical description: | Apache Tika versions 1.13 through 3.2.1 are vulnerable to XXE vi...

GHSA-642R-3GJ9-2PJ5 vulnerabilities

Vulnerabilities for packages: scala, apache-tika, druid, sonarqube, keycloak-config-cli, apicurio-registry, flyway, infinispan, dependency-track, apache-nifi, wildfly, spdx-tools-java, keycloak, apache-nifi-registry, spark, opensearch, akhq, logstash, trino, gradle, strimzi-kafka-operator, tez,...

CVE-2026-68494 vulnerabilities

Vulnerabilities for packages: scala, apache-tika, druid, sonarqube, keycloak-config-cli, apicurio-registry, flyway, infinispan, dependency-track, apache-nifi, wildfly, spdx-tools-java, keycloak, apache-nifi-registry, spark, opensearch, akhq, logstash, trino, gradle, strimzi-kafka-operator, tez,...

CVE-2018-1335

CVE-2018-1335 RCE vulnerability remote code execution on servers apache Tika-server with versions lower than 1.18 commands: sudo bash install.sh python2 exploit.py...

Apache Tika - XML External Entity Injection

Apache Tika tika-core 1.13-3.2.1, tika-pdf-module 2.0.0-3.2.1, and tika-parsers 1.13-1.28.5 contain an XML External Entity injection caused by processing crafted XFA files inside PDFs, letting attackers perform XXE attacks remotely, exploit requires crafted PDF input. id: CVE-2025-66516 info: nam...

Blackash-CVE-2025-66516

🚨 CVE-2025-66516 — Critical Apache Tika Vulnerability CVSS: 10.0 | Exploit Type: XXE Injection | Risk Level: MAXIMUM 🎯 Executive Summary CVE-2025-66516 is a critical XML External Entity XXE vulnerability in Apache Tika’s core processing engine. A single malicious PDF with XFA content can trigger:...

Alternate Path Bypass

Apache Tika is vulnerable to an alternate path bypass. The vulnerability is due to improper protection of an alternate path, where the library does not properly validate alternate file paths and attackers can supply crafted paths to access unauthorized resources...

Tika-CVE-2025-66516-Lab

CVE-2025-66516 Minimal Verification Environment This project is used to verify CVE-2025-66516 XML External Entity Injection Vulnerability in Apache Tika. Vulnerability Description Apache Tika 3.2.1 and earlier versions, when parsing PDF files containing XFA forms, did not properly disable externa...

cve-2025-54988-VulnTikaProject

Apache Tika Vulnerability Testing Project This is a Spring Boot application that uses Apache Tika 3.2.1 for document processing and text extraction. Prerequisites Have Docker Usage ./start-app.sh or docker compose up -d CVE execution Upload your malicious PDF...

Relative Path Traversal

Apache Tika is vulnerable to relative path traversal. The vulnerability is due to insufficient validation of the Study Assay File Name value in the ISA-Tab parser, where the parser concatenates the provided filename with the dataset directory without sanitizing path components and an attacker who...

Security Bulletin: Impacted IBM Optim 1.0.0 and 1.1.0  by vulnerabilities in Apache Tika PDF parser module

Summary IBM Optim versions 1.0.0 and 1.1.0 include open-source package Apache Tika that is affected by a critical vulnerability. IBM Optim 1.2.0 resolves this vulnerability by upgrading the affected open-source dependency to a fixed version. Vulnerability Details CVEID:CVE-2025-54988 DESCRIPTION:...

Ubuntu 20.04 LTS / 22.04 LTS : Apache Tika vulnerability (USN-8717-1)

The remote Ubuntu 20.04 LTS / 22.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-8717-1 advisory. It was discovered that Apache Tika's ISA-Tab parser incorrectly handled file path resolution. An attacker who could place files in a directory that Ti...

Adobe Experience Manager 6.5.0 < 6.5.3 / 2026.7.0 < 2026.8.0 Multiple Vulnerabilities (APSB26-98)

The version of Adobe Experience Manager installed on the remote host is prior to 2026.8.0, 6.5.3. It is, therefore, affected by multiple vulnerabilities as referenced in the APSB26-98 advisory. - Critical XXE in Apache Tika tika-core 1.13-3.2.1, tika-pdf-module 2.0.0-3.2.1 and tika-parsers...