CVE catalog
CVE-2026-66755
DEBIAN-CVE-2026-66755
- Severity
- Medium · CVSS 5.9
CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:X/V:X/RE:X/U:X - Published
- Updated
- Source
- [NVD] · [CVE record]
- EPSS
- 0.63% · Oct 27, 2026
It was discovered that Apache Tika's ISA-Tab parser incorrectly handled file path resolution. An attacker who could place files in a directory that Tika subsequently parses could use this issue to read arbitrary files accessible to the Tika process and have their contents emitted into the extracted text output.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Ubuntu | tika | pro | 1.22-1 | vulnerable |
| Ubuntu | tika | pro | 1.22-1ubuntu0.1~esm1 | vulnerable |
| Ubuntu | tika | pro | 1.22-1ubuntu0.1~esm2 | vulnerable |
| Ubuntu | tika | pro | 1.22-1ubuntu0.1~esm3 | fixed |
| Ubuntu | tika | pro | 1.22-2 | vulnerable |
| Ubuntu | tika | pro | 1.22-2ubuntu0.22.04.1~esm1 | vulnerable |
| Ubuntu | tika | pro | 1.22-2+deb11u1build0.22.04.1 | vulnerable |
| Ubuntu | tika | pro | 1.22-2+deb11u1ubuntu0.1~esm1 | vulnerable |
| Ubuntu | tika | pro | 1.22-2+deb11u1ubuntu0.1~esm2 | fixed |
| Debian | tika | 11 | 1.22-2 | vulnerable |
| Debian | tika | 11 | 1.22-2+deb11u1 | vulnerable |
| Cpe | tika | Not reported | Not reported | unknown |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Ubuntu | tika | deb | pro | 1.22-1ubuntu0.1~esm3 | Not reported | USN-8717-1 | Not reported |
| Ubuntu | tika | deb | pro | 1.22-2+deb11u1ubuntu0.1~esm2 | Not reported | USN-8717-1 | Not reported |
OpenFactory catalog packages
No matching packages in this catalog.
Observed:
References
- [http://www.openwall.com/lists/oss-security/2026/07/30/23]
- [https://lists.apache.org/thread/0hcctcp9s5lxgq2ookp4o6chltk99f8r]
- [https://nvd.nist.gov/vuln/detail/CVE-2026-66755]
- [https://osv.dev/vulnerability/DEBIAN-CVE-2026-66755]
- [https://osv.dev/vulnerability/USN-8717-1]
[FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database]