CVE-2018-11762

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2018-11762
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2018-11762.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2018-11762
Aliases
Downstream
Published
2018-09-19T14:29:00.397Z
Modified
2026-03-14T09:27:29.388140Z
Severity
  • 5.9 (Medium) CVSS_V3 - CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N CVSS Calculator
Summary
[none]
Details

In Apache Tika 0.9 to 1.18, in a rare edge case where a user does not specify an extract directory on the commandline (--extract-dir=) and the input file has an embedded file with an absolute path, such as "C:/evil.bat", tika-app would overwrite that file.

References

Affected packages

Git / github.com/apache/tika

Affected ranges

Type
GIT
Repo
https://github.com/apache/tika
Events
Introduced
eb1cd6a1665a9034195b30172c0199a6143bcd45
Last affected
38ff2a986af24ee255f1f91d654ea402f4016696
Database specific 
{
    "versions": [
        {
            "introduced": "0.9"
        },
        {
            "last_affected": "1.18"
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2018-11762.json"