CVE-2026-66756

CriticalCVSS 9.8

Published: 30/07/2026(UTC)Updated: 10/08/2026(UTC)Translated: 31/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.32%

24th percentile - higher than 24% of all known CVEs

Summary

Apache Tika from 4.0.0-alpha-1 to before 4.0.0-beta-1 has an improper protection of alternate path vulnerability. An attacker could exploit this to bypass security controls.

Risk Assessment

The vulnerability may allow an attacker to access unauthorized resources or perform unexpected operations on the Tika server.

Recommendation

Upgrade Apache Tika to version 4.0.0-beta-1 or later.

Original NVD description (English source)

Improper Protection of Alternate Path vulnerability in Apache Tika. This issue affects Apache Tika: from 4.0.0-alpha-1 before 4.0.0-beta-1. Users are recommended to upgrade to version 4.0.0-beta-1, which fixes the issue.