CVE-2026-66755 is a relative path traversal vulnerability in Apache Tika's ISA-Tab parser affecting versions 1.8 through 3.3.1 and 4.0.0-alpha-1. An attacker able to place files in a directory parsed by Tika can exploit this vulnerability by crafting a "Study Assay File Name" value in the ISA-Tab investigation file that traverses outside the dataset directory. This enables reading of arbitrary files accessible to the Tika process, with their contents included in the extracted text output. The vulnerability is resolved by upgrading to versions 3.3.2 or 4.0.0-beta-1.

An attacker with the ability to place files in a directory parsed by Apache Tika can read arbitrary files accessible to the Tika process. This could lead to unauthorized disclosure of sensitive information through the extracted text output. The vulnerability does not require user interaction or privileges but does require the ability to influence files parsed by Tika.

Users should upgrade Apache Tika to version 3.3.2 or 4.0.0-beta-1, where this vulnerability is fixed. No other official remediation or temporary fixes are indicated. Patch status is confirmed by the vendor advisory recommending these versions.