tika

6 results · Clear filters · Feed

• High 8.4
  CVE-2025-66516 Public exploit Scanner template EPSS 89%

  Apache Tika core, Apache Tika parsers, Apache Tika PDF parser module: Update to CVE-2025-54988 to expand scope of artifacts affected

  Critical XXE in Apache Tika tika-core (1.13-3.2.1), tika-pdf-module (2.0.0-3.2.1) and tika-parsers (1.13-1.28.5) modules on all platforms allows an attacker to carry out XML External Entity injection via a crafted XFA file inside of a PDF. This CVE covers the…

  Apache Software Foundation Apache Tika PDF parser module Apache Tika parsers Apache Tika core Debian Ubuntu Wolfi Maven
  Dec 4, 2025
• High 8.4
  CVE-2025-54988 Public exploit Scanner template EPSS 36%

  Apache Tika PDF parser module: XXE vulnerability in PDFParser's handling of XFA

  Critical XXE in Apache Tika (tika-parser-pdf-module) in Apache Tika 1.13 through and including 3.2.1 on all platforms allows an attacker to carry out XML External Entity injection via a crafted XFA file inside of a PDF. An attacker may be able to read sensiti…

  Apache Software Foundation Apache Tika PDF parser module opensearch-2 opensearch-3 Debian Ubuntu Wolfi Maven
  Aug 20, 2025
• High 7.5
  CVE-2018-11796

  Apache Tika is vulnerable to entity expansions which can lead to a denial of service attack

  In Apache Tika 1.19 (CVE-2018-11761), we added an entity expansion limit for XML parsing. However, Tika reuses SAXParsers and calls reset() after each parse, which, for Xerces2 parsers, as per the documentation, removes the user-specified SecurityManager and …

  Apache Software Foundation Apache Tika tika org.apache.tika:tika-core Ubuntu Maven
  Oct 9, 2018
• High 7.5
  CVE-2018-11761 Public exploit

  High severity vulnerability that affects org.apache.tika:tika-core

  In Apache Tika 0.1 to 1.18, the XML parsers were not configured to limit entity expansion. They were therefore vulnerable to an entity expansion vulnerability which can lead to a denial of service attack.

  Apache Software Foundation Apache Tika tika tika Debian Ubuntu Maven
  Sep 19, 2018
• High 8.1
  CVE-2018-1335 Public exploit Scanner template EPSS 94%

  Command injection in org.apache.tika:tika-core

  From Apache Tika versions 1.7 to 1.17, clients could send carefully crafted headers to tika-server that could be used to inject commands into the command line of the server running tika-server. This vulnerability only affects those running tika-server on a se…

  Apache Software Foundation Apache Tika tika tika Debian Ubuntu Maven
  Apr 25, 2018
• High 7.8
  CVE-2016-4434

  Apache Tika does not properly initialize the XML parser or choose handlers

  Apache Tika before 1.13 does not properly initialize the XML parser or choose handlers, which might allow remote attackers to conduct XML External Entity (XXE) attacks via vectors involving (1) spreadsheets in OOXML files and (2) XMP metadata in PDF and other…

  tika tika org.apache.tika:tika-core Debian Ubuntu Maven
  Sep 29, 2017