Lack of data validation - Path Traversal In org.apache.tika:tika-core
Description
Moderate severity vulnerability that affects org.apache.tika:tika-core In Apache Tika 0.9 to 1.18, in a rare edge case where a user does not specify an extract directory on the commandline (--extract-dir=) and the input file has an embedded file with an absolute path, such as "C:/evil.bat", tika-app would overwrite that file.
Mitigation
Update Impact
Minimal update. May introduce new vulnerabilities or breaking changes.
Ecosystem | Component | Affected version | Patched versions |
|---|---|---|---|
 maven | 1.19 | ||
maven | 1.19 | ||
 debian 11 | 1.20-1 |
Aliases
1. 2. 3. 4. 5. 6. 7.
References
1. 2. 3.