Description
From Apache Tika versions 1.7 to 1.17, clients could send carefully crafted headers to tika-server that could be used to inject commands into the command line of the server running tika-server. This vulnerability only affects those running tika-server on a server that is open to untrusted clients. The mitigation is to upgrade to Tika 1.18.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Apache Software Foundation | Apache Tika | 1.7 to 1.17 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 11 | tika | 1.18-1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | tika | No fix yet | — |
| Ubuntu 25.10 | tika | No fix yet | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Metasploit 1 module
-
Apache Tika Header Command Injection
exploit/windows/http/apache_tika_jp2_jscript
Exploit-DB 2
- Apache Tika 1.15 - 1.17 - Header Command Injection (Metasploit) EDB-47208 · remote · Aug 5, 2019 · verified
- Apache Tika-server < 1.18 - Command Injection EDB-46540 · remote · Mar 13, 2019 · verified
GitHub 5 repositories
-
SkyBlueEternal/CVE-2018-1335-EXP-GUI ★ 14 · Mar 20, 2019
GUI版 EXP
-
canumay/cve-2018-1335 ★ 1 · Jan 18, 2021
CENG 325 - Principles of Information Security And Privacy
-
DigitalNinja00/CVE-2018-1335 ★ 0 · Jun 6, 2024
-
siramk/CVE-2018-1335 ★ 0 · Mar 26, 2021
-
N0b1e6/CVE-2018-1335-Python3 ★ 0 · Feb 11, 2020
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- Apache Tika < 1.1.8 - Header Command Injection http/cves/2018/CVE-2018-1335.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.apache.tika:tika-core | >= 1.7, < 1.18 | 1.18 | GHSA-9r24-gp44-h3pm |