CVE-2026-66755— Apache Tika: Arbitrary Local File Read in ISArchiveParser
Possible ATT&CK Techniques 1AI
T1005 · Data from Local SystemAffected Version Matrix 2
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Apache Software Foundation | Apache Tika | 1.8< 3.3.2 | affected |
4.0.0-alpha-1< 4.0.0-beta-1 | affected |
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-66755
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Apache Tika: Arbitrary Local File Read in ISArchiveParser
Source: CVE Program / CVE List V5
Vulnerability Description
Relative Path Traversal in the ISA-Tab parser in Apache Software Foundation Apache Tika from 1.8 through 3.3.1, and 4.0.0-alpha-1, allows an attacker who can place files in a directory that the application subsequently parses to read arbitrary files accessible to the Tika process and have their contents emitted into the extracted text output, via a "Study Assay File Name" value in the ISA-Tab investigation file that traverses outside the dataset directory. Users are recommended to upgrade to version 3.3.2 or 4.0.0-beta-1, which fixes this issue.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/AU:N
Source: CVE Program / CVE List V5
Vulnerability Type
对路径名的限制不恰当(路径遍历)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Apache Software Foundation | Apache Tika | 1.8 ~ 3.3.2 | - |
II. Public POCs for CVE-2026-66755
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-66755
请登录查看更多情报信息。
Mailing List Discussions for CVE-2026-66755 (1)
Same Patch Batch · Apache Software Foundation · 2026-07-30 · 13 CVEs total
| CVE-2026-66756 | 6.9 MEDIUM | Apache Tika: unpack endpoint in tika-server allows configuration with unsecureFeatures=fal |
| CVE-2026-23981 | 5.3 MEDIUM | Apache Superset: Improper Authorization in Chart Update allowing Dashboard Modification |
| CVE-2026-23985 | 5.3 MEDIUM | Apache Superset: Regular Expression Denial of Service (ReDoS) in SQL Parser |
| CVE-2026-44613 | Apache Zeppelin: Cross-site request forgery in REST and WebSocket request handling | |
| CVE-2026-44616 | Apache Zeppelin: LDAP injection in ActiveDirectoryGroupRealm filter construction | |
| CVE-2026-44617 | Apache Zeppelin: LDAP filter injection in LdapRealm — incomplete fix of CVE-2024-31867 | |
| CVE-2026-28811 | Apache JSPWiki: Error Handling - Reveals Error Details | |
| CVE-2026-28812 | Apache JSPWiki: UserManager does not sanity-check user database at startup | |
| CVE-2026-28813 | Apache JSPWiki: JSPWiki vulnerable to JSON hijacking | |
| CVE-2026-28814 | Apache JSPWiki: Pre-Authentication Arbitrary Wiki Markup Rendering | |
| CVE-2026-48910 | Apache JSPWiki: Markdown parser allows XSS injection in Markdown error processing | |
| CVE-2026-52680 | Apache Kyuubi: REST batch multipart upload path traversal allows controlled file write |
IV. Related Vulnerabilities
Same product: Apache Tika
- CVE-2026-66756
Apache Tika: unpack endpoint in tika-server allows configura - CVE-2022-33879
Incomplete fix and new regex DoS in StandardsExtractingConte - CVE-2022-30973
Missing fix for CVE-2022-30126 in 1.28.2 - CVE-2022-30126
Apache Tika Regular Expression Denial of Service in Standard - CVE-2022-25169
Apache Tika BPGParser Memory Usage DoS
Same vendor: Apache Software Foundation
- CVE-2026-60053
Apache Answer: Residual Administrative API Key Access After - CVE-2026-60023
Apache Answer: Unauthorized disclosure of deleted or pending - CVE-2026-50749
Apache Answer: Missing authorization in revision audit rejec - CVE-2026-48912
Apache Answer: Improper authorization in avatar update clean - CVE-2026-48911
Apache Answer: Unauthenticated OAuth Email-Binding Account T
Same weakness: CWE-22
- CVE-2026-71313
rclone: Local Encoding Path Traversal - CVE-2026-18959
yushine InnoShop Files Endpoint panel-api.php destroyFiles p - CVE-2026-71309
rclone: Incomplete path validation allows backend root escap - CVE-2026-17556
Path traversal in GitHub Enterprise Server allowed unauthent - CVE-2026-18953
Improper limitation of a pathname to a restricted directory
V. Comments for CVE-2026-66755
No comments yet