https://vulnerability.circl.lu Vulnerabilities published under the CPE names of Tika. http://www.rssboard.org/rss-specification python-feedgen en Tue, 15 Sep 2026 03:59:03 +0000 https://vulnerability.circl.lu/vuln/cve-2026-66755 Apache Tika: Arbitrary Local File Read in ISArchiveParser Apache Tika: Arbitrary Local File Read in ISArchiveParser https://vulnerability.circl.lu/vuln/cve-2026-66755 Thu, 30 Jul 2026 19:16:42 +0000 https://vulnerability.circl.lu/vuln/cve-2026-66756 Apache Tika: unpack endpoint in tika-server allows configuration with unsecureFeatures=false Apache Tika: unpack endpoint in tika-server allows configuration with unsecureFeatures=false https://vulnerability.circl.lu/vuln/cve-2026-66756 Thu, 30 Jul 2026 19:18:07 +0000 https://vulnerability.circl.lu/vuln/cve-2025-54988 Apache Tika PDF parser module: XXE vulnerability in PDFParser's handling of XFA Apache Tika PDF parser module: XXE vulnerability in PDFParser's handling of XFA https://vulnerability.circl.lu/vuln/cve-2025-54988 Wed, 20 Aug 2025 20:08:49 +0000 https://vulnerability.circl.lu/vuln/cve-2025-66516 Apache Tika core, Apache Tika parsers, Apache Tika PDF parser module: Update to CVE-2025-54988 to expand scope of artifacts affected Apache Tika core, Apache Tika parsers, Apache Tika PDF parser module: Update to CVE-2025-54988 to expand scope of artifacts affected https://vulnerability.circl.lu/vuln/cve-2025-66516 Thu, 04 Dec 2025 16:17:24 +0000 https://vulnerability.circl.lu/vuln/cve-2021-28657 Infinite loop in Apache Tika's MP3 parser Infinite loop in Apache Tika's MP3 parser https://vulnerability.circl.lu/vuln/cve-2021-28657 Wed, 31 Mar 2021 07:35:14 +0000 https://vulnerability.circl.lu/vuln/cve-2018-1335 From Apache Tika versions 1.7 to 1.17, clients could send carefully crafted headers to tika-server that could be used to inject commands into the command line of the server running tika-server. This vulnerability only affects those running tika-server on a server that is open to untrusted clients. The mitigation is to upgrade to Tika 1.18. From Apache Tika versions 1.7 to 1.17, clients could send carefully crafted headers to tika-server that could be used to inject commands into the command line of the server running tika-server. This vulnerability only affects those running tika-server on a server that is open to untrusted clients. The mitigation is to upgrade to Tika 1.18. https://vulnerability.circl.lu/vuln/cve-2018-1335 Wed, 25 Apr 2018 21:00:00 +0000 https://vulnerability.circl.lu/vuln/cve-2018-8017 In Apache Tika 1.2 to 1.18, a carefully crafted file can trigger an infinite loop in the IptcAnpaParser. In Apache Tika 1.2 to 1.18, a carefully crafted file can trigger an infinite loop in the IptcAnpaParser. https://vulnerability.circl.lu/vuln/cve-2018-8017 Wed, 19 Sep 2018 14:00:00 +0000 https://vulnerability.circl.lu/vuln/cve-2018-1338 A carefully crafted (or fuzzed) file can trigger an infinite loop in Apache Tika's BPGParser in versions of Apache Tika before 1.18. A carefully crafted (or fuzzed) file can trigger an infinite loop in Apache Tika's BPGParser in versions of Apache Tika before 1.18. https://vulnerability.circl.lu/vuln/cve-2018-1338 Wed, 25 Apr 2018 21:00:00 +0000 https://vulnerability.circl.lu/vuln/cve-2018-11762 In Apache Tika 0.9 to 1.18, in a rare edge case where a user does not specify an extract directory on the commandline (--extract-dir=) and the input file has an embedded file with an absolute path, such as "C:/evil.bat", tika-app would overwrite that file. In Apache Tika 0.9 to 1.18, in a rare edge case where a user does not specify an extract directory on the commandline (--extract-dir=) and the input file has an embedded file with an absolute path, such as "C:/evil.bat", tika-app would overwrite that file. https://vulnerability.circl.lu/vuln/cve-2018-11762 Wed, 19 Sep 2018 14:00:00 +0000 https://vulnerability.circl.lu/vuln/cve-2018-11761 In Apache Tika 0.1 to 1.18, the XML parsers were not configured to limit entity expansion. They were therefore vulnerable to an entity expansion vulnerability which can lead to a denial of service attack. In Apache Tika 0.1 to 1.18, the XML parsers were not configured to limit entity expansion. They were therefore vulnerable to an entity expansion vulnerability which can lead to a denial of service attack. https://vulnerability.circl.lu/vuln/cve-2018-11761 Wed, 19 Sep 2018 14:00:00 +0000