CVE-2026-66755 Apache Tika: Arbitrary Local File Read in ISArchiveParser

Medium 5.9 Published 30 Jul 2026 Updated 1 Sep 2026

An attacker can read arbitrary local files via path traversal in the ISA-Tab parser, exposing sensitive data to the Tika process.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Local or same network only
Victim action needed: Not needed
Fix: Available

What is CVE-2026-66755?

CVE-2026-66755 is a medium-severity path traversal vulnerability in Apache Tika, published on 30 Jul 2026. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

Relative Path Traversal in the ISA-Tab parser in Apache Software Foundation Apache Tika from 1.8 through 3.3.1, and 4.0.0-alpha-1, allows an attacker who can place files in a directory that the application subsequently parses to read arbitrary files accessible to the Tika process and have their contents emitted into the extracted text output, via a "Study Assay File Name" value in the ISA-Tab investigation file that traverses outside the dataset directory. Users are recommended to upgrade to version 3.3.2 or 4.0.0-beta-1, which fixes this issue.

Weakness: CWE-22

Which versions are affected by CVE-2026-66755?

It affects 1 product.

Products include Apache Tika.

How do I fix CVE-2026-66755?

Upgrade to a fixed version.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2026-66755 being exploited?

There is no known exploitation of CVE-2026-66755 in the wild and no public exploit code.

Sources

Also known as CLEANSTART-2026-SC57620, DEBIAN-CVE-2026-66755, GHSA-vrmh-37mg-28h3, UBUNTU-CVE-2026-66755, USN-8717-1.