SB20260824141 - Multiple vulnerabilities in Apache Tika

Description

This security bulletin contains information about 2 vulnerabilities.

1) Path traversal (CVE-ID: CVE-2026-66755)

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to path traversal in ISArchiveParser when parsing an ISA-Tab investigation file containing a crafted "Study Assay File Name" value. A remote attacker can place files in a directory that the application subsequently parses to disclose sensitive information.

The issue can cause contents of arbitrary files accessible to the Tika process to be emitted into the extracted text output.

2) Link following (CVE-ID: CVE-2026-66756)

CWE-ID: CWE-59 - Improper Link Resolution Before File Access ('Link Following')

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to access files via an alternate path.

The vulnerability exists due to improper protection of alternate path in the unpack endpoint of tika-server when handling unpack requests. A remote attacker can send a specially crafted request to access files via an alternate path.

Remediation

Install update from vendor's website.

References

• https://lists.apache.org/api/email.lua?id=f3qp581p9z4pgp5qqtbpbpbn0tzr4t29
• https://lists.apache.org/api/email.lua?id=w1y0yd105bffjqpy9w051qlfn8sxs8b4
• https://tika.apache.org/