Source: tika Version: 1.22-2 Severity: grave Tags: security upstream X-Debbugs-Cc: [email protected], Debian Security Team <[email protected]>
Hi, The following vulnerability was published for tika. CVE-2026-66755[0]: | Relative Path Traversal in the ISA-Tab parser in Apache Software | Foundation Apache Tika from 1.8 through 3.3.1, and 4.0.0-alpha-1, | allows an attacker who can place files in a directory that the | application subsequently parses to read arbitrary files accessible | to the Tika process and have their contents emitted into the | extracted text output, via a "Study Assay File Name" value in the | ISA-Tab investigation file that traverses outside the dataset | directory. Users are recommended to upgrade to version 3.3.2 or | 4.0.0-beta-1, which fixes this issue. If you fix the vulnerability please also make sure to include the CVE (Common Vulnerabilities & Exposures) id in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-66755 https://www.cve.org/CVERecord?id=CVE-2026-66755 [1] https://lists.apache.org/thread/0hcctcp9s5lxgq2ookp4o6chltk99f8r Please adjust the affected versions in the BTS as needed. Regards, Salvatore
