Skip to content
OpenAdvisories
Medium USN-8717-1 1 CVE

tika vulnerability

Published Sep 3, 2026 · Updated Sep 3, 2026

Ecosystem: Ubuntu

Summary

It was discovered that Apache Tika's ISA-Tab parser incorrectly handled
file path resolution. An attacker who could place files in a directory that
Tika subsequently parses could use this issue to read arbitrary files
accessible to the Tika process and have their contents emitted into the
extracted text output.

Fixed packages 2

ReleasePackageFixed in
Ubuntu · Pro 20.04 LTS Pro:20.04:LTS tika 1.22-1ubuntu0.1~esm3
Ubuntu · Pro 22.04 LTS Pro:22.04:LTS tika 1.22-2+deb11u1ubuntu0.1~esm2

Vulnerabilities 1

  • Medium 5.9
    CVE-2026-66755

    Apache Tika: Arbitrary Local File Read in ISArchiveParser

    Relative Path Traversal in the ISA-Tab parser in Apache Software Foundation Apache Tika from 1.8 through 3.3.1, and 4.0.0-alpha-1, allows an attacker who can place files in a directory that the application subsequently parses to read arbitrary files accessibl…

    Apache Software Foundation Apache Tika tika tika Debian Ubuntu

References

  • report
    https://ubuntu.com/security/CVE-2026-66755