CVE-2018-1335

Command injection in org.apache.tika:tika-core

8.1 HighPublic exploitFix available

From Apache Tika versions 1.7 to 1.17, clients could send carefully crafted headers to tika-server that could be used to inject commands into the command line of the server running tika-server. This vulnerability only affects those running tika-server on a server that is open to untrusted clients. The mitigation is to upgrade to Tika 1.18.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: High
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

93.6%Up 37.8 points since Apr 14, 2021

What each source reports

NVD Score used 8.1

Record: CVE-2018-1335
CVSS 3.0: 8.1 HighCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0: 9.3 HighAV:N/AC:M/Au:N/C:C/I:C/A:C
Updated: 2026-11-02

CVE List No score

Record: CVE-2018-1335
Updated: 2026-11-02

EUVDEUVD-2018-0566 No score

Record: EUVD-2018-0566
Updated: 2026-11-03

GitHub AdvisoriesGHSA-9r24-gp44-h3pm 8.1

Command injection in org.apache.tika:tika-core

Record: GHSA-9r24-gp44-h3pm
CVSS 3.0: 8.1 HighCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSV 8.1

Record: CVE-2018-1335
CVSS 3.0: 8.1 HighCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVDEBIAN-CVE-2018-1335 8.1

Record: DEBIAN-CVE-2018-1335
CVSS 3.0: 8.1 HighCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVGHSA-9r24-gp44-h3pm 8.1

Command injection in org.apache.tika:tika-core

Record: GHSA-9r24-gp44-h3pm
CVSS 3.0: 8.1 HighCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVUBUNTU-CVE-2018-1335 8.1

Record: UBUNTU-CVE-2018-1335
CVSS 3.0: 8.1 HighCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`org.apache.tika:tika-core` Maven	1.7 up to 1.18	1.18
`tika` Debian:11	before 1.18-1	1.18-1
`org.apache.tika:tika-core` Maven	1.7 up to 1.18, plus listed versions 1.101.111.121.131.14 Show 5 moreShow less 1.151.161.171.81.9	1.18
`tika` Ubuntu:25.10	All versions, plus listed versions 1.22-2	None known
`tika` Ubuntu:26.10	All versions, plus listed versions 1.22-2	None known

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
Exploit-DB	Apache Tika-server < 1.18 - Command Injection	2019-03-13
Exploit-DB	Apache Tika 1.15 - 1.17 - Header Command Injection (Metasploit)	2019-08-05
Metasploit	Apache Tika Header Command Injection	2018-04-25
Nuclei	Apache Tika < 1.1.8 - Header Command Injection
PoC in GitHub	DigitalNinja00/CVE-2018-1335	2024-06-06
PoC in GitHub	N0b1e6/CVE-2018-1335-Python3	2020-02-11
PoC in GitHub	SkyBlueEternal/CVE-2018-1335-EXP-GUI	2019-03-20
PoC in GitHub	canumay/cve-2018-1335	2021-01-18
PoC in GitHub	siramk/CVE-2018-1335	2021-03-26

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, Exploit-DB, GitHub Advisories, Metasploit, Nuclei, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2018-1335 is a high vulnerability (CVSS 8.1) in Apache Tika, published April 25, 2018. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 93.6%, the 99th percentile. Fixed in org.apache.tika:tika-core 1.18.

References

Show 6 moreShow less