CVE-2026-66755 Apache CVE debrief

Who should care

Apache Tika users, administrators of systems where Tika is deployed, and security teams responsible for vulnerability management should be aware of this vulnerability and take action to mitigate it. They should review their systems for exposure, apply patches or mitigations, and monitor for suspicious activity. Additionally, they should verify their inventory of affected systems and implement compensating controls to limit file system access if patches cannot be applied immediately. Security teams should also track exceptions and retest remediated assets to ensure the vulnerability is fully addressed. This vulnerability has a CVSS score of 5.9 and a severity of MEDIUM, indicating a moderate level of risk. Therefore, affected organizations should prioritize mitigation efforts accordingly. Users of Apache Tika should also review the official CVE and NVD records for further information and guidance on mitigation and remediation. Furthermore, users should consider implementing monitoring and detection controls to identify potential exploitation attempts. By taking these steps, organizations can reduce the risk associated with this vulnerability and protect their systems from potential attacks. It is also recommended that users verify their system configurations and ensure that they are running the latest version of Apache Tika. Users should also be aware of potential limitations in the available information and the potential for changes in the attack surface over time. Finally, users should consider engaging with their security teams to discuss the potential impact of this vulnerability on their specific environments and to develop a plan for mitigation and remediation. The CVE-2026-66755 vulnerability in Apache Tika's ISA-Tab parser is a significant threat to organizations that use Apache Tika, and users should take immediate action to mitigate the vulnerability and protect their systems. The vulnerability can be mitigated by upgrading to version 3.3.2 or 4.0.0-beta-1, and users should prioritize this mitigation effort. In addition to upgrading, users should also implement compensating controls, such as restricting access to the Tika process and its parsed ... (o

Technical summary

The ISA-Tab parser in Apache Tika from versions 1.8 through 3.3.1, and 4.0.0-alpha-1, is vulnerable to a Relative Path Traversal attack. An attacker can manipulate the 'Study Assay File Name' in the ISA-Tab investigation file to read arbitrary files accessible to the Tika process. The vulnerability is fixed in versions 3.3.2 and 4.0.0-beta-1. Apache Tika users should prioritize upgrading to these versions to mitigate the vulnerability.

Defensive priority

Apache Tika users should prioritize upgrading to version 3.3.2 or 4.0.0-beta-1 to mitigate the Relative Path Traversal vulnerability.

Recommended defensive actions

• Upgrade Apache Tika to version 3.3.2 or 4.0.0-beta-1
• Restrict access to the Tika process and its parsed directories
• Monitor Tika logs for suspicious file access patterns
• Implement compensating controls to limit file system access
• Verify and update inventory of affected systems

Evidence notes

The CVE-2026-66755 vulnerability in Apache Tika's ISA-Tab parser allows attackers to read arbitrary files by manipulating the 'Study Assay File Name' in the ISA-Tab investigation file. Users are recommended to upgrade to version 3.3.2 or 4.0.0-beta-1. Evidence is based on official CVE and NVD records, as well as vendor advisories.

Official resources