Bug#1143459: tika: CVE-2026-66755

Source: tika
Version: 1.22-2
Severity: grave
Tags: security upstream
X-Debbugs-Cc: [email protected], Debian Security Team <[email protected]>

Hi,

The following vulnerability was published for tika.

CVE-2026-66755[0]:
| Relative Path Traversal in the ISA-Tab parser in Apache Software
| Foundation Apache Tika from 1.8 through 3.3.1, and 4.0.0-alpha-1,
| allows an attacker who can place files in a directory that the
| application subsequently parses to read arbitrary files accessible
| to the Tika process and have their contents emitted into the
| extracted text output, via a "Study Assay File Name" value in the
| ISA-Tab investigation file that traverses outside the dataset
| directory. Users are recommended to upgrade to version 3.3.2 or
| 4.0.0-beta-1, which fixes this issue.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-66755
    https://www.cve.org/CVERecord?id=CVE-2026-66755
[1] https://lists.apache.org/thread/0hcctcp9s5lxgq2ookp4o6chltk99f8r

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore