Vulnerability · Published Jul 30, 2026 · Assigned by apache
CVE-2026-66755Apache Tika: Arbitrary Local File Read in ISArchiveParser
Medium 5.9
In plain English
A medium-severity path traversal in Apache Tika from Apache Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 50% of all known vulnerabilities).
Official description
Relative Path Traversal in the ISA-Tab parser in Apache Software Foundation Apache Tika from 1.8 through 3.3.1, and 4.0.0-alpha-1, allows an attacker who can place files in a directory that the application subsequently parses to read arbitrary files accessible to the Tika process and have their contents emitted into the extracted text output, via a "Study Assay File Name" value in the ISA-Tab investigation file that traverses outside the dataset directory. Users are recommended to upgrade to version 3.3.2 or 4.0.0-beta-1, which fixes this issue.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu:24.04:LTS | tika | no fix listed | UBUNTU-CVE-2026-66755 |
| Ubuntu:26.04:LTS | tika | no fix listed | UBUNTU-CVE-2026-66755 |
| Ubuntu:26.10 | tika | no fix listed | UBUNTU-CVE-2026-66755 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Apache Software Foundation | Apache Tika | 1.8 – before 3.3.24.0.0-alpha-1 – before 4.0.0-beta-1 |
Weakness: CWE-22 · Vector: CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/AU:N