CVE-2026-66755: Apache Tika: Arbitrary Local File Read in ISArchiveParser

[Tim Allison <tallison () apache org>]

Severity: 

Affected versions:

- Apache Tika (org.apache.tika:tika-parser-scientific-module) 1.8 before 3.3.2
- Apache Tika (org.apache.tika:tika-parser-scientific-module) 4.0.0-alpha-1 before 4.0.0-beta-1

Description:

Relative Path Traversal in the ISA-Tab parser in Apache Software Foundation Apache Tika from 1.8 through 3.3.1, and 
4.0.0-alpha-1, allows an attacker who can place files in a directory that the application subsequently parses to read 
arbitrary files accessible to the Tika process and have their contents emitted into the extracted text output, via a 
"Study Assay File Name" value in the ISA-Tab investigation file that traverses outside the dataset directory. Users are 
recommended to upgrade to version 3.3.2 or 4.0.0-beta-1, which fixes this issue.

Credit:

Reported by BugQore, who supplied a patch in PR #2873. (finder)
Independently reported with proposed fix by Rui Heng Koh. (finder)

References:

https://tika.apache.org/
https://www.cve.org/CVERecord?id=CVE-2026-66755