SB2026090359 - Ubuntu update for tika

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026090359

SB2026090359 - Ubuntu update for tika

Published: September 3, 2026

Security Bulletin ID SB2026090359
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact Information disclosure

Breakdown by Severity

Medium 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 vulnerability.


1) Path traversal (CVE-ID: CVE-2026-66755)

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to path traversal in ISArchiveParser when parsing an ISA-Tab investigation file containing a crafted "Study Assay File Name" value. A remote attacker can place files in a directory that the application subsequently parses to disclose sensitive information.

The issue can cause contents of arbitrary files accessible to the Tika process to be emitted into the extracted text output.


Remediation

Install update from vendor's website.

References