CVEs-PoC/2018/CVE-2018-11762.md

CVE-2018-11762

Description

In Apache Tika 0.9 to 1.18, in a rare edge case where a user does not specify an extract directory on the commandline (--extract-dir=) and the input file has an embedded file with an absolute path, such as "C:/evil.bat", tika-app would overwrite that file.

POC

Reference

No PoCs from references.

Github

• https://github.com/PuddinCat/GithubRepoSpider