Skip to content
CVE PROGRAM SOURCE RECORD6.9 Medium

CVE-2026-66756

Apache Tika: unpack endpoint in tika-server allows configuration with unsecureFeatures=false

Description

Improper Protection of Alternate Path vulnerability in Apache Tika. This issue affects Apache Tika: from 4.0.0-alpha-1 before 4.0.0-beta-1. Users are recommended to upgrade to version 4.0.0-beta-1, which fixes the issue.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Apache Software Foundation Apache Tika

Default version status: unaffected

  • 4.0.0-alpha-1 to < 4.0.0-beta-1affected

References