Back Linuxsecurity

Ubuntu Apache Tika Important Info Exposure USN-8717-1 CVE-2026

Linuxsecurity •LinuxSecurity Advisories • September 3, 2026

Keep your Linux systems secure and up to date with practical patching guidance. Review Linux Patching Best Practices ×

Apache Tika could be made to expose sensitive information over the network. Software Description: - tika: A content analysis toolkit Details: It was discovered that Apache Tika's ISA-Tab parser incorrectly handled file path resolution. An attacker who could place files in a directory that Tika subsequently parses could use this issue to read arbitrary files accessible to the Tika process and have their contents emitted into the extracted text output.

Apache Tika could be made to expose sensitive information over the

Software Description:

- tika: A content analysis toolkit

It was discovered that Apache Tika's ISA-Tab parser incorrectly handled

file path resolution. An attacker who could place files in a directory that

Tika subsequently parses could use this issue to read arbitrary files

accessible to the Tika process and have their contents emitted into the

extracted text output.

The problem can be corrected by updating your system to the following package versions: Ubuntu 22.04 LTS libtika-java 1.22-2+deb11u1ubuntu0.1~esm2 Available with Ubuntu Pro Ubuntu 20.04 LTS libtika-java 1.22-1ubuntu0.1~esm3 Available with Ubuntu Pro In general, a standard system update will make all the necessary changes.

Ubuntu Security Notice USN-8717-1

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Apache Tika Vulnerability Exposes Sensitive Information A vulnerability in Apache Tika's ISA-Tab parser was discovered, allowing attackers to exploit improper file path resolution. An attacker with access to a directory that Tika parses could read arbitrary files accessible to the Tika process, leading to potential information exposure. This flaw affects users of Apache Tika, particularly those running versions in Ubuntu 20.04 LTS and 22.04 LTS. The issue has been assigned CVE-2026-XXXX, and users are advised to update their systems to mitigate the risk. A standard system update will apply the necessary changes. Ubuntu Pro users have extended security coverage for affected packages. The vulnerability was disclosed on September 3, 2026, and is critical for maintaining data security in environments utilizing Tika. 2 sources 45

Extracted Entities

Ubuntu Apache Tika Important Info Exposure USN-8717-1 CVE-2026

The full story

Extracted Entities

Attack Types (1)

Companies (1)

CWE Weaknesses (1)

Platforms (1)