CVE-2026-66756
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk24th percentile - higher than 24% of all known CVEs
Summary
Apache Tika from 4.0.0-alpha-1 to before 4.0.0-beta-1 has an improper protection of alternate path vulnerability. An attacker could exploit this to bypass security controls.
Risk Assessment
The vulnerability may allow an attacker to access unauthorized resources or perform unexpected operations on the Tika server.
Recommendation
Upgrade Apache Tika to version 4.0.0-beta-1 or later.
Other vulnerabilities in Apache Tika
See all- CVE-2016-4434High
Apache Tika before 1.13 does not properly initialize the XML parser or choose handlers, which might allow remote attackers to conduct XML External Entity (XXE) attacks via vectors involving spreadsheets in OOXML files and XMP metadata in PDF and other file formats.
- CVE-2016-6809Critical
Apache Tika before 1.14 allows Java code execution for serialized objects embedded in MATLAB files. The issue exists because Tika invokes JMatIO to do native deserialization.
- CVE-2026-66755High
Apache Tika from version 1.8 through 3.3.1 and 4.0.0-alpha-1 has a relative path traversal vulnerability in the ISA-Tab parser. An attacker can place files in a directory and then read arbitrary files accessible to the Tika process via a crafted "Study Assay File Name" value.
Original NVD description (English source)
Improper Protection of Alternate Path vulnerability in Apache Tika. This issue affects Apache Tika: from 4.0.0-alpha-1 before 4.0.0-beta-1. Users are recommended to upgrade to version 4.0.0-beta-1, which fixes the issue.