Executive brief
Apache Tika, a content analysis toolkit used to extract text and metadata from various file formats, contains a vulnerability in its scientific data parser. An attacker who can place a specially crafted file in a directory scanned by the application can trick the system into reading sensitive files from the underlying server. This could lead to the unauthorized exposure of internal configuration files or other private data accessible to the application.
Technical details
A relative path traversal vulnerability exists in the ISA-Tab parser within the Apache Tika scientific module. The flaw is located in the handling of the 'Study Assay File Name' value within ISA-Tab investigation files. An attacker with the ability to place files in a directory parsed by Tika can use traversal sequences (e.g., ../) to reference files outside the intended dataset directory. When processed, the contents of these arbitrary files are emitted into Tika's extracted text output. The issue is resolved in versions 3.3.2 and 4.0.0-beta-1.
Affected products
- Apache Software Foundation Apache Tika (tika-parser-scientific-module) 1.8 through 3.3.1, 4.0.0-alpha-1
Timeline
- 2026-07-30: disclosed
- 2026-07-30: advisory