PatchTheCVECVE-2026-66755: Relative Path Traversal in the ISA-Tab parser in Apache Software Foundation Apache Tika from 1.8 through 3.3.1
49
This month
HIGH 7.5REMOTEWATCHLISTUPGRADE
CVE-2026-66755 is a high-severity flaw (CVSS 7.5) affecting tika. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
Relative Path Traversal in the ISA-Tab parser in Apache Software Foundation Apache Tika from 1.8 through 3.3.1, and 4.0.0-alpha-1, allows an attacker who can place files in a directory that the application subsequently parses to read arbitrary files accessible to the Tika process and have their contents emitted into the extracted text output, via a "Study Assay File Name" value in the ISA-Tab investigation file that traverses outside the dataset
Why this priority
- High severity
- Remotely exploitable, no login, no user action
- On your watchlist
A fixed release or distro patch exists.
Risk facts
| CVSS score | 7.5 (High) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | None |
| User interaction | None |
| EPSS exploit chance | 0.6% (top 50%) |
| CISA exploited list | No |
| Weakness | CWE-22 |
| Published | 2026-07-30 |
| Last modified | 2026-10-23 |
Publisher (CNA): Apache Software Foundation · Vendor: apache
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
apache tika UPGRADE
Affected: >= 1.8 and < 3.3.2 · 4.0.0 alpha1 · 4.0.0 beta1-rc1
Fixed in: 3.3.2
Safe to downgrade to: a release before 1.8
1. Check installed version
apt-cache policy tika || rpm -q tika || tika --version
2. UPGRADE to 3.3.2 (Debian / Ubuntu)
sudo apt update && sudo apt install --only-upgrade tika
2. UPGRADE (RHEL / Amazon Linux / Fedora)
sudo dnf upgrade tika
Note
Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.
3. If no update is available yet, DOWNGRADE to a release before 1.8 (Debian / Ubuntu)
apt-cache madison tika
sudo apt install tika=<VERSION_BEFORE_1.8>
sudo apt-mark hold tika
3. If no update is available yet, DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list tika
sudo dnf downgrade tika-<VERSION_BEFORE_1.8>
sudo dnf versionlock add tika
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
Exact fixes by distribution
Fedora 46 · python-fontconfig · FIXED · 0.6.3-1.fc46 · FEDORA-2026-f92ca8b01f · source
sudo dnf upgrade --advisory=FEDORA-2026-f92ca8b01f
Fedora ELN · valgrind · FIXED · 3.28.0-1.eln159 · FEDORA-2026-c593ef1d15 · source
sudo dnf upgrade --advisory=FEDORA-2026-c593ef1d15
Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Related CVEs
- CVE-2026-66756 CRITICAL 9.8 DOWNGRADE Improper Protection of Alternate Path vulnerability in Apache Tika. This issue affects Apache Tika: from 4.0.