Relative Path Traversal in the ISA-Tab parser in Apache Software Foundation Apache Tika from 1.8 through 3.3.1, and 4.0.0-alpha-1, allows an attacker who can place files in a directory that the application subsequently parses to read arbitrary files accessible to the Tika process and have their contents emitted into the extracted text output, via a "Study Assay File Name" value in the ISA-Tab investigation file that traverses outside the dataset directory. Users are recommended to upgrade to version 3.3.2 or 4.0.0-beta-1, which fixes this issue.
Fix
Patch, vendor advisory and mitigation references on NVD 1
- https://lists.apache.org/thread/0hcctcp9s5lxgq2ookp4o6chltk99f8r Mailing List, Vendor Advisory
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
Change history 1
- First seenCVSS 5.9 · apacheNVD modified 2026-10-23 22:10
Affected (CPE criteria) 3
cpe:2.3:a:apache:tika:*:*:*:*:*:*:*:*cpe:2.3:a:apache:tika:4.0.0:alpha1:*:*:*:*:*:*cpe:2.3:a:apache:tika:4.0.0:beta1-rc1:*:*:*:*:*:*
References 2
- https://lists.apache.org/thread/0hcctcp9s5lxgq2ookp4o6chltk99f8r Mailing List, Vendor Advisory
- http://www.openwall.com/lists/oss-security/2026/07/30/23 Mailing List, Third Party Advisory