# CVE-2026-66755: Apache Tika path traversal in ISA-Tab parser

Source: https://junglewise.ai/threats/cve-2026-66755-apache-tika-path-traversal-in-isa-tab-parser  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-30. Updated: 2026-07-30  
License: CC BY 4.0 with a link back

CVE-2026-66755 · Severity: info · CVSS 5.9 · Published 2026-07-30

Apache Tika, a content analysis toolkit used to extract text and metadata from various file formats, contains a vulnerability in its scientific data parser. An attacker who can place a specially crafted file in a directory scanned by the application can trick the system into reading sensitive files from the underlying server. This could lead to the unauthorized exposure of internal configuration files or other private data accessible to the application.

Vendors: [Apache Software Foundation](https://junglewise.ai/threats/vendors/apache-software-foundation).

## Quick answers

**Is CVE-2026-66755 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-66755 being exploited in the wild.

**How severe is CVE-2026-66755?** Informational severity, with a CVSS score of 5.9, published 30 July 2026.

**Which products and versions are affected?** Apache Software Foundation Apache Tika (tika-parser-scientific-module) 1.8 through 3.3.1, 4.0.0-alpha-1.

**Is there a fix for CVE-2026-66755?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-66755 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2026-66755?** Check whether you run Apache Software Foundation Tika Scientific Parser Module. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A relative path traversal vulnerability exists in the ISA-Tab parser within the Apache Tika scientific module. The flaw is located in the handling of the 'Study Assay File Name' value within ISA-Tab investigation files. An attacker with the ability to place files in a directory parsed by Tika can use traversal sequences (e.g., ../) to reference files outside the intended dataset directory. When processed, the contents of these arbitrary files are emitted into Tika's extracted text output. The issue is resolved in versions 3.3.2 and 4.0.0-beta-1.

## Affected products

- Apache Software Foundation Apache Tika (tika-parser-scientific-module) 1.8 through 3.3.1, 4.0.0-alpha-1

## Timeline

- 2026-07-30: disclosed
- 2026-07-30: advisory

## References

- [https://repo.maven.apache.org/maven2](https://repo.maven.apache.org/maven2)
- [https://lists.apache.org/thread/0hcctcp9s5lxgq2ookp4o6chltk99f8r](https://lists.apache.org/thread/0hcctcp9s5lxgq2ookp4o6chltk99f8r)
- [http://www.openwall.com/lists/oss-security/2026/07/30/23](http://www.openwall.com/lists/oss-security/2026/07/30/23)