CVE-2026-66755— Apache Tika: Arbitrary Local File Read in ISArchiveParser
Quick assessment
Affected
Apache Software Foundation Apache Tika
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Apache Tika是美国Apache基金会的一个内容解析与信息提取框架。 Apache Tika 1.8版本至3.3.1版本和4.0.0-alpha-1版本存在路径遍历漏洞，该漏洞源于ISA-Tab解析器的相对路径遍历问题，攻击者可通过ISA-Tab调查文件中的“Study Assay File Name”值遍历数据集目录之外，读取Tika进程可访问的任意文件并将其内容输出到提取的文本输出。
Possible ATT&CK Techniques 1 AI
T1005 · Data from Local SystemAffected Version Matrix 2
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Apache Software Foundation | Apache Tika | 1.8< 3.3.2 |
affected |
4.0.0-alpha-1< 4.0.0-beta-1 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-66755
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Apache Tika: Arbitrary Local File Read in ISArchiveParser
Source: CVE Program / CVE List V5
Vulnerability Description
Relative Path Traversal in the ISA-Tab parser in Apache Software Foundation Apache Tika from 1.8 through 3.3.1, and 4.0.0-alpha-1, allows an attacker who can place files in a directory that the application subsequently parses to read arbitrary files accessible to the Tika process and have their contents emitted into the extracted text output, via a "Study Assay File Name" value in the ISA-Tab investigation file that traverses outside the dataset directory. Users are recommended to upgrade to version 3.3.2 or 4.0.0-beta-1, which fixes this issue.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/AU:N
Source: CVE Program / CVE List V5
Vulnerability Type
对路径名的限制不恰当(路径遍历)
Source: CVE Program / CVE List V5
Vulnerability Title
Apache Tika 路径遍历漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Apache Tika是美国Apache基金会的一个内容解析与信息提取框架。 Apache Tika 1.8版本至3.3.1版本和4.0.0-alpha-1版本存在路径遍历漏洞，该漏洞源于ISA-Tab解析器的相对路径遍历问题，攻击者可通过ISA-Tab调查文件中的“Study Assay File Name”值遍历数据集目录之外，读取Tika进程可访问的任意文件并将其内容输出到提取的文本输出。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Apache Software Foundation | Apache Tika | 1.8 ~ 3.3.2 | - |
|
II. Public POCs for CVE-2026-66755
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-66755
请登录查看更多情报信息。
Mailing List Discussions for CVE-2026-66755 (1)
Same Patch Batch · Apache Software Foundation · 2026-07-30 · 13 CVEs total
| CVE-2026-66756 | 6.9 MEDIUM | Apache Tika: unpack endpoint in tika-server allows configuration with unsecureFeatures=fal |
| CVE-2026-23981 | 5.3 MEDIUM | Apache Superset: Improper Authorization in Chart Update allowing Dashboard Modification |
| CVE-2026-23985 | 5.3 MEDIUM | Apache Superset: Regular Expression Denial of Service (ReDoS) in SQL Parser |
| CVE-2026-44613 | Apache Zeppelin: Cross-site request forgery in REST and WebSocket request handling | |
| CVE-2026-44616 | Apache Zeppelin: LDAP injection in ActiveDirectoryGroupRealm filter construction | |
| CVE-2026-44617 | Apache Zeppelin: LDAP filter injection in LdapRealm — incomplete fix of CVE-2024-31867 | |
| CVE-2026-28811 | Apache JSPWiki: Error Handling - Reveals Error Details | |
| CVE-2026-28812 | Apache JSPWiki: UserManager does not sanity-check user database at startup | |
| CVE-2026-28813 | Apache JSPWiki: JSPWiki vulnerable to JSON hijacking | |
| CVE-2026-28814 | Apache JSPWiki: Pre-Authentication Arbitrary Wiki Markup Rendering | |
| CVE-2026-48910 | Apache JSPWiki: Markdown parser allows XSS injection in Markdown error processing | |
| CVE-2026-52680 | Apache Kyuubi: REST batch multipart upload path traversal allows controlled file write |
IV. Related Vulnerabilities
Same product: Apache Tika
-
CVE-2026-66756
Apache Tika: unpack endpoint in tika-server allows configura -
CVE-2022-33879
Incomplete fix and new regex DoS in StandardsExtractingConte -
CVE-2022-30973
Missing fix for CVE-2022-30126 in 1.28.2 -
CVE-2022-30126
Apache Tika Regular Expression Denial of Service in Standard -
CVE-2022-25169
Apache Tika BPGParser Memory Usage DoS
Same vendor: Apache Software Foundation
-
CVE-2026-63686
Apache HTTP Server: mod_xml2enc crash on charset conversion -
CVE-2026-93546
Apache HTTP Server: mod_dav_fs namespace overflow -
CVE-2026-79768
Apache HTTP Server: mod_userdir information disclosure -
CVE-2026-73637
Apache HTTP Server: mod_auth_digest DoS attack -
CVE-2026-73636
Apache HTTP Server: mod_auth_digest one-time-nonce replay at
Same weakness: CWE-22
-
CVE-2026-103884
Keycloak-services: keycloak-services: path traversal in x.50 -
CVE-2026-101889
Prime Mover < 2.2.1 Path Traversal via wprime-config.json -
CVE-2026-101888
Prime Mover < 2.2.1 Zip Slip Path Traversal File Write -
CVE-2026-94620
Classroom 50 vulnerable to arbitrary file overwrite on the t -
CVE-2026-95588
WordPress AcyMailing SMTP Newsletter plugin <= 11.0.5 - Arbi
V. Comments for CVE-2026-66755
No comments yet