CVE-2026-66755

Awaiting Analysis Awaiting Analysis - Queue

Relative Path Traversal in Apache Tika ISA-Tab Parser

Publication date: 2026-07-30

Last updated on: 2026-07-30

Assigner: Apache Software Foundation

Description

Relative Path Traversal in the ISA-Tab parser in Apache Software Foundation Apache Tika from 1.8 through 3.3.1, and 4.0.0-alpha-1, allows an attacker who can place files in a directory that the application subsequently parses to read arbitrary files accessible to the Tika process and have their contents emitted into the extracted text output, via a "Study Assay File Name" value in the ISA-Tab investigation file that traverses outside the dataset directory. Users are recommended to upgrade to version 3.3.2 or 4.0.0-beta-1, which fixes this issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-30

Last Modified

2026-07-30

Generated

2026-07-31

AI Q&A

2026-07-31

EPSS Evaluated

N/A

NVD

CVE-2026-66755

EUVD

EUVD-2026-51277

Affected Vendors & Products

Vendor	Product	Version / Range
apache	apache_tika	From 1.8 (inc) to 3.3.1 (inc)
apache	apache_tika	From 4.0.0-alpha-1 (inc) to 4.0.0-beta-1 (inc)
apache	apache_tika	3.3.2
apache	apache_tika	4.0.0-beta-1

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-22	The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

Executive Summary

This vulnerability is a Relative Path Traversal in the ISA-Tab parser of Apache Tika versions 1.8 through 3.3.1 and 4.0.0-alpha-1. It allows an attacker who can place files in a directory to manipulate the 'Study Assay File Name' value in an ISA-Tab investigation file to read arbitrary files accessible to the Tika process. These files' contents are then included in the extracted text output.

Detection Guidance

This vulnerability involves relative path traversal in Apache Tika's ISA-Tab parser. To detect it, check for Apache Tika versions between 1.8 and 3.3.1 or 4.0.0-alpha-1. Verify if any directories containing ISA-Tab investigation files are accessible to untrusted users. Inspect file paths in 'Study Assay File Name' values for unusual directory traversals like '../'.

Impact Analysis

If exploited, this vulnerability could allow unauthorized access to sensitive files on the system running the vulnerable Apache Tika version. Attackers could read files containing confidential data, potentially leading to data breaches or further system compromise depending on the file contents.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating compliance requirements under GDPR, HIPAA, and other regulations. Organizations may face legal penalties, reputational damage, and loss of trust due to data exposure resulting from this flaw.

Mitigation Strategies

Upgrade Apache Tika to version 3.3.2 or 4.0.0-beta-1 or later to fix the Relative Path Traversal vulnerability.

Hi! I’m here to help you understand CVE-2026-66755. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70