Apache Software Foundation · Apache Tika
Apache Tika's tika-server component, in versions 1.7 through 1.17 of Apache Tika, fails to properly handle specially crafted client-supplied headers, which can be used to inject commands into the server's command line. An attacker can exploit this when tika-server is reachable by untrusted clients, since the flaw only affects deployments exposed to such clients.
From Apache Tika versions 1.7 to 1.17, clients could send carefully crafted headers to tika-server that could be used to inject commands into the command line of the server running tika-server. This vulnerability only affects those running tika-server on a server that is open to untrusted clients. The mitigation is to upgrade to Tika 1.18.
First seen exploited 6 years after disclosure. Public exploit code (Metasploit) was available the same day.
6 fixes in tika-core over 17 months. The latest fix listed for tika-core is 1.19.
No ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.
1 package in 1 ecosystem. Main package: org.apache.tika:tika-core.
Upgrade to 1.18
Still affected on this line by CVE-2025-66516 (fixed in 3.2.2, a newer line).
Set the version to 1.18 or later in your pom.xml or build.gradle.
The first fix for CVE-2018-1335.
| If you run | Upgrade to |
|---|---|
| 1.7 up to 1.18 | 1.18 |
“Up to” means the second version is the fix and is not affected.
Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.