Apache Tika Vulnerability Exposes Sensitive Information

A vulnerability in Apache Tika's ISA-Tab parser was discovered, allowing attackers to exploit improper file path resolution. An attacker with access to a directory that Tika parses could read arbitrary files accessible to the Tika process, leading to potential information exposure. This flaw affects users of Apache Tika, particularly those running versions in Ubuntu 20.04 LTS and 22.04 LTS. The issue has been assigned CVE-2026-XXXX, and users are advised to update their systems to mitigate the risk. A standard system update will apply the necessary changes. Ubuntu Pro users have extended security coverage for affected packages. The vulnerability was disclosed on September 3, 2026, and is critical for maintaining data security in environments utilizing Tika.

Key Points: • Apache Tika's ISA-Tab parser has a vulnerability allowing arbitrary file reading. • Affected systems include Ubuntu 20.04 LTS and 22.04 LTS with specific package versions. • Users are advised to update their systems to mitigate the risk.