CVE-2026-60093

Name of the Vulnerable Software and Affected Versions Apache Camel versions 4.0.0 through 4.14.8 Apache Camel versions 4.15.0 through 4.18.3 Apache Camel versions 4.19.0 through 4.21.x

Description A relative path traversal issue exists in the camel-azure-storage-datalake component during the downloadToFile operation. The component writes files to a local directory specified by the fileDir endpoint option by joining it with the remote path name provided by the Azure SDK without lexical normalization or boundary checks. Because the DataLakeConsumer.createBatchExchangesFromPath function creates exchanges from PathItem.getName() verbatim, a remote file name containing parent-directory segments can resolve to a location outside the intended fileDir. This allows an attacker who can influence file names in the consumed Data Lake filesystem to create or overwrite files on the local filesystem with the privileges of the Camel process, potentially leading to a loss of file integrity or further privilege escalation.

Recommendations Upgrade to version 4.14.9 for those on the 4.14.x LTS releases stream. Upgrade to version 4.18.4 for those on the 4.18.x releases stream. Upgrade to version 4.22.0 for all other affected versions. As a temporary mitigation, use the regex endpoint option to ensure only simple single-segment names are accepted, filtering out any names with path separators or parent-directory segments. Avoid using the downloadToFile operation on untrusted filesystems and instead use a file name controlled by the route. Treat object names in externally writable Data Lake filesystems as untrusted input and avoid deriving local filesystem paths from them.