description: In Apache Tika 0.9 to 1.18, in a rare edge case where a user does not specify an extract directory on the commandline (--extract-dir=) and the input file has an embedded file with an absolute path, such as "C:/evil.bat", tika-app would overwrite that file.
problem types: Zip Slip Vulnerability in Apache Tika's tika-app
affected:
{
product: Apache Tika
vendor: Apache Software Foundation
versions:
status: affected, version: 0.9 to 1.18
}