The vulnerability (CVE-2026-66755) is a relative path traversal in the ISA-Tab parser component of Apache Tika. It affects versions from 1.8 through 3.3.1 and the 4.0.0-alpha-1 release. An attacker capable of placing files in directories parsed by Tika can exploit the "Study Assay File Name" field in ISA-Tab investigation files to traverse directories outside the dataset directory. This enables reading arbitrary files accessible to the Tika process and including their contents in the extracted text output. The issue is fixed in versions 3.3.2 and 4.0.0-beta-1.

Successful exploitation allows an attacker to read arbitrary files accessible to the Apache Tika process by manipulating file path references in ISA-Tab investigation files. This could lead to unauthorized disclosure of sensitive information contained in those files. There is no indication of privilege escalation, denial of service, or code execution. No known exploits in the wild have been reported.

Users should upgrade Apache Tika to version 3.3.2 or later, or to 4.0.0-beta-1 or later, where this vulnerability is fixed. No other mitigations are indicated by the vendor advisory. Patch status is confirmed fixed in these versions.