CVE-2026-66755

This path traversal in Apache Tika's ISA-Tab parser (CVE-2026-66755) affects versions 1.8 through 3.3.1, fixed in 3.3.2 and 4.0.0-beta-1. The vulnerability lives in how the parser handles the 'Study Assay File Name' field — a legitimate ISA-Tab feature designed to reference companion data files within a dataset directory. The parser was not validating that referenced files stayed within the expected dataset boundary, allowing attackers to read arbitrary files on the system. The CVSS 5.9 rating fundamentally mischaracterizes this vulnerability's risk profile. The key is the precondition: 'an attacker who can place files in a directory that Tika subsequently parses.' In typical network-facing vulnerability modeling, this sounds like a theoretical local-attacker scenario. But in Tika's actual deployment patterns — batch metadata extraction services, pipeline processors handling uploaded files, indexers consuming third-party datasets — that precondition describes normal operation. The attacker doesn't need special access; they're already placing files through the system's intended function. If Tika processes untrusted ISA-Tab files in any multi-tenant or automated pipeline context, this is a reconnaissance and exfiltration vector, not a minor file-read limitation. One file per parse operation sounds constrained until you recognize that the extracted content flows into downstream systems — Elasticsearch clusters, ML pipelines, document intelligence tools — that trust Tika's output unconditionally. An attacker can map directory structures, pull /etc/passwd, locate .env files, or identify AWS credentials embedded in config files. The file read is the feature; the blast radius lives in whatever consumes the extracted text afterward. Check your deployment: if Tika processes files from untrusted or multi-tenant sources — uploaded documents, third-party datasets, monitored directories for batch processing — treat this as high priority regardless of the CVSS score. Verify your Tika version is 3.3.2 or later. If you're running an older version, understand that the 'theoretical' precondition is likely already satisfied by your operational model.

Reviewed through automated stages and approved by a human before publication.