CVE-2018-11762: org.apache.tika:tika-core - Absolute Path File Overwrite
Summary
CVE-2018-11762: Moderate severity vulnerability that affects org.apache.tika:tika-core. Affects org.apache.tika:tika-core versions >= 0.9, < 1.19. Fixed in 1.19. How to fix ↓
Also tracked for
- tika · Debian:11
The same CVE-2018-11762 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
org.apache.tika:tika-core is a Maven package that provides core functionality for Apache Tika, a content analysis toolkit. It is used for extracting metadata and text content from various file formats. This package is vulnerable to an issue where, in a specific scenario, if a user does not specify an extract directory and the input file contains an embedded file with an absolute path, the tika-app tool would overwrite that file.
Vulnerability Detail
This vulnerability affects Apache Tika versions 0.9 to 1.18. In the mentioned edge case, if the user does not provide an extract directory and the input file contains an embedded file with an absolute path (e.g., "C:/evil.bat"), tika-app would overwrite that file. This could potentially lead to unauthorized modification or deletion of files on the system. The vulnerability has a CVSS score of 5.9 (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N).
How To Fix
Latest published version: 4.1.0 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.19
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
In conclusion, the org.apache.tika:tika-core package is vulnerable to an issue where tika-app can overwrite files with absolute paths in a specific scenario. Upgrading to Apache Tika version 1.19 or later is recommended to fix this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.tika:tika-core →
FAQ
The vulnerability allows for potential unauthorized modification or deletion of files on the system.
Versions 0.9 to 1.18 of Apache Tika are affected by this vulnerability.
Yes, upgrading to Apache Tika version 1.19 or later fixes this vulnerability.
No specific workarounds have been mentioned for this vulnerability.
The CVSS score of this vulnerability is 5.9 (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N).
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.tika:tika-core.
