CVE-2026-66906
CriticalCVSS 9.1Exploitation Probability (EPSS)
Low risk43th percentile - higher than 43% of all known CVEs
Summary
Relative path traversal vulnerability in Apache Camel Azure Storage Blob component allows writing files outside the configured directory during downloadBlobToFile operation. Blob names with parent-directory segments are not normalized, enabling overwriting arbitrary files with Camel process privileges.
Risk Assessment
An attacker who can influence blob names in an Azure Storage container can overwrite files outside the target directory, leading to data integrity loss and potentially privilege escalation depending on process write permissions.
Recommendation
Upgrade immediately to version 4.22.0 (or 4.14.9 for 4.14.x LTS, 4.18.4 for 4.18.x). If immediate upgrade is not possible, restrict blob names using the regex endpoint option (accepting only simple names without path separators) or avoid downloadBlobToFile on untrusted containers.
Other vulnerabilities in Apache Camel
See all- CVE-2015-5348High
Apache Camel versions 2.6.x through 2.14.x, 2.15.x before 2.15.5, and 2.16.x before 2.16.1, when using camel-jetty or camel-servlet as consumers in Camel routes, allow remote attackers to execute arbitrary commands via a crafted serialized Java object in an HTTP request.
- CVE-2014-0002High
The XSLT component in Apache Camel before 2.11.4 and 2.12.x before 2.12.3 allows remote attackers to read arbitrary files and possibly have other unspecified impact via an XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
- CVE-2026-71300Critical
Vulnerability in Apache Camel Atmosphere Websocket component due to improper input validation of Exchange headers outside the Camel namespace (websocket.connectionKey, websocket.connectionKey.list, websocket.sendToAll, websocket.eventType, websocket.errorType). An external attacker can supply the list header via HTTP and take over the producer's dispatch decision, potentially suppressing or redirecting notifications to a different client.
- CVE-2026-56140Critical
The Apache Camel AWS SNS component lacks an inbound filter rule in the Sns2HeaderFilterStrategy. However, the vulnerability is not exploitable because the component is producer-only (does not support consumers), so an attacker cannot supply external message attributes to the Camel Exchange. A defense-in-depth filter was added for consistency with other strategies.
- CVE-2026-53913Critical
A vulnerability in the camel-keycloak component of Apache Camel allows bypassing access token verification in the default configuration. When required roles or permissions are empty, the token is not cryptographically verified, allowing access to protected routes with any Authorization header.
- CVE-2026-48205Critical
A vulnerability in the Apache Camel DNS component allows SSRF attacks via improper input validation of message headers. An attacker can set dns.server, dns.name, and dns.domain headers in an HTTP request, redirecting DNS queries to a controlled server and disclosing internal hostnames.
- CVE-2026-48204Critical
Vulnerability in Apache Camel's mongodb-gridfs component allows an attacker to manipulate GridFS operations via HTTP headers. Improper input validation and access control enable unauthorized file deletion, reading, enumeration, and NoSQL operator injection.
- CVE-2026-48203Critical
Vulnerability in Apache Camel Solr component allows SSRF and injection of Solr parameters and fields. Exchange headers with SolrParam. and SolrField. prefixes are passed unfiltered from HTTP requests to the Solr producer, enabling attackers to manipulate queries and indexed documents.
- CVE-2026-46456Critical
Vulnerability in Apache Camel AWS2-SQS component allows attackers to inject Camel control headers (e.g., CamelHttpUri, CamelFileName) via SQS messages. Missing inbound filtering in Sqs2HeaderFilterStrategy enables modification of downstream producer behavior in the route.
- CVE-2026-46455Critical
The camel-keycloak component in Apache Camel lacks validation of the access token's validity window. The helper function does not check whether the token is expired or not yet valid, accepting tokens outside their intended lifetime.
Original NVD description (English source)
Relative path traversal vulnerability in Apache Camel Azure Storage Blob component. This issue affects Apache Camel: from 4.0.0 before 4.14.9, from 4.15.0 before 4.18.4, from 4.19.0 before 4.22.0. The camel-azure-storage-blob component can download an Azure Storage blob to the local filesystem through its downloadBlobToFile operation, writing into the directory named by the fileDir endpoint option, which is documented as usable from both the producer and the consumer. BlobOperations.downloadBlobToFile built the local target by joining fileDir with the remote blob name exactly as the Azure SDK reported it (new File(fileDir, client.getBlobName())) and passed the result straight to the SDK download call, with no lexical normalization and no check that the resolved location stayed inside fileDir. The blob name is not route-controlled data: the consumer enumerates the container in BlobConsumer.createBatchExchangesFromContainer, which lists blobs and creates one exchange per entry from BlobItem.getName() verbatim, applying no name filtering by default. A blob name containing parent-directory segments therefore resolved to a location outside the configured fileDir, letting anyone able to influence the names present in the consumed container cause Camel to create or overwrite a file at a location of their choosing, with the privileges of the Camel process. Depending on what the process can write to, overwriting a file outside the download directory can escalate beyond the loss of integrity of that file. Azure Storage blob containers use a flat namespace in which the blob name is an opaque key, so a name carrying such segments is stored and listed as given. The fileDir option is an ordinary common-group configuration parameter and carries no security marker, so nothing signalled to users that its value was not being enforced as a containment boundary. Camel's other file-download consumers - camel-file, camel-ftp, camel-smb, camel-mina-sftp and camel-azure-files - already constrained their local downloads to the configured directory using a path-segment boundary check; the camel-azure-storage-blob download path was not covered by that work. Users are recommended to upgrade to version 4.22.0, which fixes the issue. If users are on the 4.14.x LTS releases stream, then they are suggested to upgrade to 4.14.9. If users are on the 4.18.x releases stream, then they are suggested to upgrade to 4.18.4. For deployments that cannot upgrade immediately, constrain the names the consumer will act on using the regex endpoint option, which is applied to each listed blob name as a full-string match, so that only simple single-segment names are accepted and any name carrying a path separator or a parent-directory segment is filtered out before an exchange is created; the prefix option can additionally narrow the listing server-side, noting that when both are set regex takes priority and prefix is ignored. Alternatively, avoid the downloadBlobToFile operation on untrusted containers and write the payload from the route under a file name the route itself controls, rather than one taken from the remote listing. As defence in depth, treat the blob names in any externally writable container as untrusted input and do not derive local filesystem paths from them.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS