Severity: Affected versions:
- Apache Tika (org.apache.tika:tika-parser-scientific-module) 1.8 before 3.3.2 - Apache Tika (org.apache.tika:tika-parser-scientific-module) 4.0.0-alpha-1 before 4.0.0-beta-1 Description: Relative Path Traversal in the ISA-Tab parser in Apache Software Foundation Apache Tika from 1.8 through 3.3.1, and 4.0.0-alpha-1, allows an attacker who can place files in a directory that the application subsequently parses to read arbitrary files accessible to the Tika process and have their contents emitted into the extracted text output, via a "Study Assay File Name" value in the ISA-Tab investigation file that traverses outside the dataset directory. Users are recommended to upgrade to version 3.3.2 or 4.0.0-beta-1, which fixes this issue. Credit: Reported by BugQore, who supplied a patch in PR #2873. (finder) Independently reported with proposed fix by Rui Heng Koh. (finder) References: https://tika.apache.org/ https://www.cve.org/CVERecord?id=CVE-2026-66755
