CVE-2018-1335 in the critical feed json
Command injection in org.apache.tika:tika-core
published 2018-04-25 8 y ago modified 2026-06-17 4 mo ago also GHSA-9r24-gp44-h3pm , EUVD-2018-0566
- cvss
- 8.1
- version 3.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 93.6%
- EPSS 93.6% chance of exploitation in 30 days, percentile 99.8%
- public exploits
- 3
- Metasploit, Exploit-DB, plus a Nuclei check
Summary
From Apache Tika versions 1.7 to 1.17, clients could send carefully crafted headers to tika-server that could be used to inject commands into the command line of the server running tika-server. This vulnerability only affects those running tika-server on a server that is open to untrusted clients. The mitigation is to upgrade to Tika 1.18.
Patch / fix
- maven org.apache.tika:tika-core 1.18
- apache tika 1.18
- tika Debian 11 1.18-1
debian advisories DEBIAN-CVE-2018-1335
Vendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
red hat product security vex CVE-2018-1335 updated cvss 8.8
tika: Command injection in tika-server can allow remote attackers to execute arbitrary commands via crafted headers
-
Red Hat Satellite 5 tikaaffected: no fix planned “Will not fix”
-
Red Hat JBoss Data Virtualization 6.4.8fixed: vendor fix RHSA-2019:3140
-
Red Hat BPM Suite 6 tika-core Red Hat Fuse 7 camel-tika camel-tika Red Hat JBoss BRMS 5 tika-core Red Hat JBoss BRMS 6 tika-core Red Hat JBoss Fuse Integration Service 2 tika-core Red Hat JBoss Fuse Service Works 6 tika-corenot affected: vulnerable code not present
+1 more productsfewer
Red Hat Software Collections rh-eclipse46-tika, rh-eclipse46-tika-java7, rh-eclipse46-tika-javadoc, rh-eclipse46-tika-parsers, rh-eclipse46-tika-serialization
Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf
Timeline
- First public exploit (Metasploit exploit/windows/http/apache_tika_jp2_jscript)
- Published
Exploit prediction
93.64% chance of exploitation in the next 30 days, higher than 99.8% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- Metasploit exploit/windows/http/apache_tika_jp2_jscript Apache Tika Header Command Injection metasploit exploit, excellent rank, 2018-04-25
- EDB-47208 Apache Tika 1.15 - 1.17 - Header Command Injection (Metasploit) remote, 2019-08-05
- EDB-46540 Apache Tika-server < 1.18 - Command Injection remote, 2019-03-13
- Nuclei template Apache Tika < 1.1.8 - Header Command Injection nuclei detection template
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.0 | 8.1 | CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 9.3 | AV:N/AC:M/Au:N/C:C/I:C/A:C |
| GitHub | 3.0 | 8.1 | CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| maven | org.apache.tika:tika-core | >=1.7, <1.18 |
1.18 |
Affected products
- Apache Software Foundation Apache Tika
References
-
exploit-db.com
/exploits/46540/
exploit, third-party-advisory, vdb-entry
-
access.redhat.com
/errata/RHSA-2019:3140
vendor-advisory, web
-
lists.apache.org
/thread.html/b3ed4432380af767effd4c6f27665cc7b2686acccbefeb9f55851dca%40%3Cdev.tika.apache.org%3E
mailing-list
-
securityfocus.com
/bid/104001
vdb-entry, web, third-party-advisory
-
packetstormsecurity.com
/files/153864/Apache-Tika-1.17-Header-Command-Injection.html
web
-
nvd.nist.gov
/vuln/detail/CVE-2018-1335
advisory
-
github.com
/advisories/GHSA-9r24-gp44-h3pm
advisory
-
lists.apache.org
/thread.html/b3ed4432380af767effd4c6f27665cc7b2686acccbefeb9f55851dca@%3Cdev.tika.apache.org%3E
web
-
exploit-db.com
/exploits/46540
web
Sources
- CVE List CVE-2018-1335
- GitHub Advisory GHSA-9r24-gp44-h3pm
- NVD CVE-2018-1335
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.