PatchTheCVECVE-2026-66756: Improper Protection of Alternate Path vulnerability in Apache Tika. This issue affects Apache Tika: from 4.0.
58
This month
CRITICAL 9.8REMOTEWATCHLISTDOWNGRADE
CVE-2026-66756 is a critical-severity flaw (CVSS 9.8) affecting tika. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
Improper Protection of Alternate Path vulnerability in Apache Tika. This issue affects Apache Tika: from 4.0.0-alpha-1 before 4.0.0-beta-1. Users are recommended to upgrade to version 4.0.0-beta-1, which fixes the issue.
Why this priority
- Critical severity
- Remotely exploitable, no login, no user action
- On your watchlist
A fixed release or distro patch exists.
Risk facts
| CVSS score | 9.8 (Critical) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | None |
| User interaction | None |
| EPSS exploit chance | 0.7% (top 46%) |
| CISA exploited list | No |
| Weakness | CWE-424 |
| Published | 2026-07-30 |
| Last modified | 2026-10-23 |
Publisher (CNA): Apache Software Foundation · Vendor: apache
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
apache tika DOWNGRADE
Affected: 4.0.0 alpha1 · 4.0.0 beta1-rc1
Fixed in: no fixed release known
Safe to downgrade to: a release before 4.0.0
1. Check installed version
apt-cache policy tika || rpm -q tika || tika --version
2. No fixed release: DOWNGRADE to a release before 4.0.0 (Debian / Ubuntu)
apt-cache madison tika
sudo apt install tika=<VERSION_BEFORE_4.0.0>
sudo apt-mark hold tika
2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list tika
sudo dnf downgrade tika-<VERSION_BEFORE_4.0.0>
sudo dnf versionlock add tika
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
Exact fixes by distribution
A distro patch exists: prefer upgrading over downgrading.
Fedora 46 · pspp · FIXED · 2.1.3-2.fc46 · FEDORA-2026-0d6444911b · source
sudo dnf upgrade --advisory=FEDORA-2026-0d6444911b
Fedora ELN · barman · FIXED · 3.20.1-3.eln159 · FEDORA-2026-45ecf042c2 · source
sudo dnf upgrade --advisory=FEDORA-2026-45ecf042c2
Ubuntu 20.04 · tika · NOT AFFECTED
Ubuntu 22.04 · tika · NOT AFFECTED
Ubuntu 24.04 · tika · NOT AFFECTED
Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Related CVEs
- CVE-2026-66755 HIGH 7.5 UPGRADE Relative Path Traversal in the ISA-Tab parser in Apache Software Foundation Apache Tika from 1.8 through 3.3.1