CVE-2018-1335: Apache Tika tika-server header command injection

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

high priorityRemote code execution with no authentication or interaction required, high EPSS, and public exploit code, though exploitation requires an internet-exposed tika-server.

What it is

Apache Tika versions 1.7 through 1.17 allow clients to send crafted headers to tika-server that are injected into the server's command line, enabling command execution. It only affects deployments where tika-server is exposed to untrusted clients, but in that configuration it is a full remote code execution flaw.

Impact

An attacker can execute arbitrary operating system commands with the privileges of the tika-server process, leading to full compromise of the host and any data it can reach.

Attack surface

Reached over the network by sending crafted HTTP headers to an exposed tika-server instance; no authentication or user interaction is required per the CVSS vector (AV:N/PR:N/UI:N).

Exploitation

Not listed in CISA KEV, but EPSS is very high (0.93758, 99.8th percentile) and public exploit code exists (Exploit-DB 46540, Packet Storm), indicating active interest and easy weaponization.

What to do

• Upgrade Apache Tika to 1.18 or later, which is the documented fix.
• If upgrade is not immediate, remove tika-server from untrusted network exposure and restrict access to trusted clients only.
• Place tika-server behind authentication and network ACLs or a reverse proxy that filters headers.
• Run tika-server with a least-privilege service account and no unnecessary filesystem or shell access.
• Monitor for and block requests containing shell metacharacters in headers.

Detection

• Inspect tika-server HTTP request logs for headers containing shell metacharacters such as ;, |, $(), backticks, or newlines.
• Alert on unexpected child processes spawned by the tika-server process (e.g., sh, bash, cmd.exe, curl, wget).
• Monitor outbound network connections originating from the tika-server host to unfamiliar destinations.
• Review host process telemetry for command lines that include tika-server-related arguments combined with shell interpreters.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.