Arbitrary File Overwrite

Apache tika-app is vulnerable to arbitrary file overwrite. An input file that has an embedded file containing an absolute path such as C:/evil.dll will cause the application to overwrite the file when the extract directory tag --extract-dir= is not specified on the commandline...

CVE-2018-11762

In Apache Tika 0.9 to 1.18, in a rare edge case where a user does not specify an extract directory on the commandline --extract-dir= and the input file has an embedded file with an absolute path, such as "C:/evil.bat", tika-app would overwrite that file...

PT-2018-10811

Name of the Vulnerable Software and Affected Versions Apache Tika versions 0.9 through 1.18 Description The issue arises in a rare edge case where a user does not specify an extract directory on the command line and the input file has an embedded file with an absolute path. For example, if the...

CVE-2018-11762: Improper Limitation of a Pathname to a Restricted Directory

In Apache Tika 0.9 to 1.18, in a rare edge case where a user does not specify an extract directory on the commandline --extract-dir= and the input file has an embedded file with an absolute path, such as "C:/evil.bat", tika-app would overwrite that file...