CRITICAL🇵🇱 Wersja polska

CVE-2016-6809

CVSS 9.8v3.1pub. 2017-04-06upd. 2026-05-13

Apache Tika before 1.14 allows Java code execution for serialized objects embedded in MATLAB files. The issue exists because Tika invokes JMatIO to do native deserialization.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

  • Apache Nutch

    APP
    Apache
    2.3.1

  • Apache Tika

    APP
    Apache
    ≤ 1.13
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
RCEDeserialization
CWE
References

Related vulnerabilities

CVE-2021-23901CRITICAL9.1PL ✓same product

XXE injection w Apache Nutch DmozParser — odczyt plików i SSRF

CVE-2025-66516HIGH8.4same product

Critical XXE in Apache Tika tika-core (1.13-3.2.1), tika-pdf-module (2.0.0-3.2.1) and tika-parsers (1.13-1.28....

CVE-2025-54988HIGH8.4same product

Critical XXE in Apache Tika (tika-parser-pdf-module) in Apache Tika 1.13 through and including 3.2.1 on all pl...

CVE-2021-33813HIGH7.5same product

An XXE issue in SAXBuilder in JDOM through 2.0.6 allows attackers to cause a denial of service via a crafted H...

CVE-2019-10094HIGH7.8same product

A carefully crafted package/compressed file that, when unzipped/uncompressed yields the same file (a quine), c...