The vulnerability is a relative path traversal flaw in the ISA‑Tab parser of Apache Tika that allows an attacker able to write files into a parsed directory to craft a "Study Assay File Name" that points outside the intended dataset, resulting in the parser reading any file the Tika process can access and embedding its contents into the extracted text output. This enables the attacker to read arbitrary local files such as configuration files, logs, or other sensitive data, potentially exposing confidential information. The flaw is classified as CWE-22.

Affected systems include all installations of Apache Tika from version 1.8 through 3.3.1 and the 4.0.0‑alpha‑1 pre‑release. The security advisory recommends upgrading to version 3.3.2 or any later release such as 4.0.0‑beta‑1, which contain the patch. Systems that use the ISA‑Tab parser and have writable directories exposed to a threat actor are vulnerable.

The CVSS score of 5.9 indicates moderate severity, while the EPSS score of less than 1% and the absence from the CISA KEV catalog suggest a low likelihood of widespread exploitation. The attack requires local write access to a directory processed by the ISA‑Tab parser, which may be achieved by a local user or an insider. If exploited, the attacker can read any file accessible to the Tika process, potentially gaining confidential data but does not provide remote code execution or privilege escalation. Overall, the risk is moderate severity with limited exploitability due to restrictive prerequisites.