Apache Tika vulnerabilities

2 known vulnerabilities in Apache Tika from Apache. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 9.8 Critical severity

  Apache Tika: Improper Protection of Alternate Path

  CVE-2026-66756Jul 30, 2026Apache

  Improper Protection of Alternate Path vulnerability in Apache Tika. This issue affects Apache Tika: from 4.0.0-alpha-1 before 4.0.0-beta-1. Users are recommended to upgrade to version 4.0.0-beta-1, which fixes the issue.

• 7.5 High severity

  Apache Tika: Improper Limitation of a Pathname to a Restricted Directory

  CVE-2026-66755Jul 30, 2026Apache

  Relative Path Traversal in the ISA-Tab parser in Apache Software Foundation Apache Tika from 1.8 through 3.3.1, and 4.0.0-alpha-1, allows an attacker who can place files in a directory that the application subsequently parses to read arbitrary files accessible