Which versions of Apache Tika are affected by CVE-2026-66755?

Apache Tika document processing software (versions 1.8-3.3.1 and 4.0.0-alpha-1) contains a path traversal vulnerability in its ISA-Tab parser enabling unauthorized read access to any file accessible…. A patch is available.

How to fix or mitigate CVE-2026-66755?

Within 24 hours, identify all systems and applications using Apache Tika versions 1.8 through 3.3.1 or 4.0.0-alpha-1 for document processing, and assess whether they process ISA-Tab formatted files; simultaneously determine the scope of data accessible to each Tika process. Within 7 days, implement interim controls by either disabling ISA-Tab format support in Tika configurations, restricting the Tika process file system access to explicitly whitelisted directories using OS-level permissions and containerization, or implementing strict input validation that whitelists only trusted ISA-Tab file sources. Within 30 days, establish monitoring of Apache Tika security advisories for patch release notifications; when patches become available, develop and execute an upgrade plan prioritizing systems processing sensitive data classification; alternatively, evaluate migration to alternative scientific data parsing libraries without this vulnerability.

Apache Tika CVE-2026-66755

Q: What is the CVSS score of CVE-2026-66755?

CVE-2026-66755 has a CVSS 4.0 base score of 5.9 (Medium). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-51277 MEDIUM

Path Traversal (CWE-22)

2026-07-30

GHSA-vrmh-37mg-28h3

Path Traversal Apache Tika

5.9

CVSS 4.0 · Vendor

Severity by source

Vendor (CNA) PRIMARY

5.9 MEDIUM

CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:X/V:X/RE:X/U:X

vuln.today AI

7.5 HIGH

Network vector because tika-server accepts unauthenticated uploads; no integrity or availability impact, only arbitrary file read.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (CNA).

CVSS VectorVendor

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jul 30, 2026 - 20:03 EUVD

Analysis Generated

Jul 30, 2026 - 18:16 vuln.today

CVE Published

Jul 30, 2026 - 17:53 oss-security

HIGH

Description PRE-NVD

Disclosed via oss-security. NVD scoring and full description are pending.

AnalysisAI

Relative path traversal in Apache Tika's ISA-Tab parser (ISArchiveParser) enables arbitrary local file read against the Tika process. Specifically, the 'Study Assay File Name' field within an ISA-Tab investigation file is processed without adequate path sanitization, allowing traversal outside the intended dataset directory and causing the contents of any file readable by the Tika process to be emitted in the extracted text output. Affected deployments span Apache Tika 1.8 through 3.3.1 and the 4.0.0-alpha-1 preview release, all of which include the vulnerable tika-parser-scientific-module. No public exploit or CISA KEV listing was identified at time of analysis, but the vulnerability was independently reported by two researchers with proposed patches, indicating the issue is reproducible and well-understood.

Technical ContextAI

Apache Tika is a content detection and extraction toolkit widely used in search engines, data pipelines, and content management systems. This vulnerability resides specifically in the tika-parser-scientific-module (org.apache.tika:tika-parser-scientific-module), an optional add-on that handles scientific data formats including ISA-Tab. ISA-Tab is an open tabular format used in life sciences and bioinformatics research to describe investigation/study/assay structures. The ISArchiveParser processes ISA-Tab archives, reading metadata fields such as 'Study Assay File Name' to locate and parse associated data files. Because this field is consumed as a relative file path without normalization or boundary enforcement, a crafted value such as '../../etc/passwd' or '../../../../proc/self/environ' will resolve outside the archive's dataset directory, causing the parser to open and stream the target file's raw contents into Tika's extracted text output. The root cause class is CWE-23 (Relative Path Traversal), a failure to canonicalize user-controlled path components before filesystem operations. No CPE string was provided in the input data, but the affected Maven artifact is org.apache.tika:tika-parser-scientific-module, versions 1.8 through 3.3.1 and 4.0.0-alpha-1.

RemediationAI

The primary remediation is to upgrade to Apache Tika 3.3.2 (stable branch) or 4.0.0-beta-1 (alpha/preview branch), both of which include the fix contributed via PR #2873. Upgrade documentation and downloads are available at https://tika.apache.org/. If an immediate upgrade is not possible, the most effective workaround is to exclude or not deploy the tika-parser-scientific-module JAR, which removes the ISArchiveParser entirely; the trade-off is loss of ISA-Tab and related scientific format parsing capability. Alternatively, if Tika is deployed as tika-server, restrict the set of accepted MIME types to exclude ISA-Tab ('application/isa-tab' or equivalent) via server configuration, preventing the vulnerable parser from being invoked; verify the effective MIME type Tika assigns to ISA-Tab archives in your environment before relying on this control. For deployments where files are processed from a directory, apply strict filesystem permissions to ensure only trusted processes can write to the Tika-monitored input directories, which limits the attacker's ability to plant a malicious ISA-Tab file. Note that tika-server 3.3.2 also tightens defaults by requiring enableUnsecureFeatures=true for the /pipes, /async, and /status endpoints, providing an additional defense-in-depth improvement.