CVE-2018-1335: org.apache.tika:tika-core - Command Injection Vulnerability
Summary
CVE-2018-1335: Command injection in org.apache.tika:tika-core. Affects org.apache.tika:tika-core versions >= 1.7, < 1.18. Fixed in 1.18. How to fix ↓
Also tracked for
- tika · Debian:11
The same CVE-2018-1335 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
org.apache.tika:tika-core is a Maven package that provides core functionality for Apache Tika, a content analysis toolkit. Tika is used to detect and extract metadata and text from various file formats. This vulnerability affects versions 1.7 to 1.17 of Tika, specifically when running the tika-server component on a server open to untrusted clients.
Vulnerability Detail
The vulnerability allows clients to send specially crafted headers to the tika-server, enabling them to inject arbitrary commands into the server's command line. This can lead to remote code execution and unauthorized access to the server. It is important to note that this vulnerability only affects servers running tika-server and exposed to untrusted clients.
How To Fix
Latest published version: 4.1.0 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.18
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. It is advised to upgrade to the fixed version as soon as possible.
Conclusion
The command injection vulnerability in org.apache.tika:tika-core versions 1.7 to 1.17 can be mitigated by upgrading to Tika 1.18 or later. It is crucial to promptly update the package to ensure the server is protected against unauthorized command execution. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for org.apache.tika:tika-core →
FAQ
The vulnerability allows remote attackers to execute arbitrary commands on the server running tika-server, potentially leading to unauthorized access and remote code execution.
Versions 1.7 to 1.17 of Apache Tika are affected by this vulnerability.
No, this vulnerability requires the tika-server to be running on a server that is open to untrusted clients.
The recommended mitigation is to upgrade to Tika version 1.18 or later, which includes the necessary fixes for this vulnerability.
Yes, the CVSS score for this vulnerability is 8.1 (High severity).
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.tika:tika-core.
