Medium [CVE-2026-66755] Apache Tika: Arbitrary Local File Read in ISArchiveParser
This medium-severity Apache Software Foundation advisory covers CVE-2026-66755 affecting Apache Tika.
Android app · Google Play
Monitor future Apache Software Foundation CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.
Summary
Relative Path Traversal in the ISA-Tab parser in Apache Software Foundation Apache Tika from 1.8 through 3.3.1, and 4.0.0-alpha-1, allows an attacker who can place files in a directory that the application subsequently parses to read arbitrary files accessible to the Tika process and have their contents emitted into the extracted text output, via a "Study Assay File Name" value in the ISA-Tab investigation file that traverses outside the dataset directory.
Users are recommended to upgrade to version 3.3.2 or 4.0.0-beta-1, which fixes this issue.
- Apache Tika 1.8 before 3.3.2
- Apache Tika 4.0.0-alpha-1 before 4.0.0-beta-1
Official advisory · high-confidence parse· fetched 2 months ago·verify at source
- 3.3.2
- 4.0.0-beta-1
Official advisory · high-confidence parse· fetched 2 months ago·verify at source
Mitigation checklist
- Users are recommended to upgrade to version 3.3.2 or 4.0.0-beta-1, which fixes this issue.
Official advisory · high-confidence parse· fetched 2 months ago·verify at source
Discussion(0)
No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.
Sign in to join the discussion.