The vulnerability (CVE-2026-66755) is a relative path traversal in the ISA-Tab parser component of Apache Tika. It affects versions from 1.8 through 3.3.1 and 4.0.0-alpha-1. An attacker with the ability to place files in a directory that Apache Tika subsequently parses can exploit this flaw by using a specially crafted "Study Assay File Name" in the ISA-Tab investigation file. This causes the parser to read files outside the intended dataset directory and include their contents in the extracted text output. The issue is fixed in versions 3.3.2 and 4.0.0-beta-1.

An attacker able to place files in a directory parsed by Apache Tika can read arbitrary files accessible to the Tika process. This can lead to unauthorized disclosure of sensitive information through the extracted text output. There is no indication of privilege escalation or remote code execution. The vulnerability requires local file placement capability.

Users should upgrade Apache Tika to version 3.3.2 or 4.0.0-beta-1, where this vulnerability is fixed. No other mitigations are indicated by the vendor advisory. Patch status is confirmed by the advisory recommending these versions.