Hiep Nguyen

**Name of the Vulnerable Software and Affected Versions** Apache Camel versions 4.0.0 through 4.14.8 Apache Camel versions 4.15.0 through 4.18.3 Apache Camel versions 4.19.0 through 4.21.x **Description** A relative path traversal issue exists in the `camel-azure-storage-datalake` component during the `downloadToFile` operation. The component writes files to a local directory specified by the `fileDir` endpoint option by joining it with the remote path name provided by the Azure SDK without lexical normalization or boundary checks. Because the `DataLakeConsumer.createBatchExchangesFromPath` function creates exchanges from `PathItem.getName()` verbatim, a remote file name containing parent-directory segments can resolve to a location outside the intended `fileDir`. This allows an attacker who can influence file names in the consumed Data Lake filesystem to create or overwrite files on the local filesystem with the privileges of the Camel process, potentially leading to a loss of file integrity or further privilege escalation. **Recommendations** Upgrade to version 4.14.9 for those on the 4.14.x LTS releases stream. Upgrade to version 4.18.4 for those on the 4.18.x releases stream. Upgrade to version 4.22.0 for all other affected versions. As a temporary mitigation, use the `regex` endpoint option to ensure only simple single-segment names are accepted, filtering out any names with path separators or parent-directory segments. Avoid using the `downloadToFile` operation on untrusted filesystems and instead use a file name controlled by the route. Treat object names in externally writable Data Lake filesystems as untrusted input and avoid deriving local filesystem paths from them.

**Name of the Vulnerable Software and Affected Versions** Apache Camel versions 4.0.0 through 4.14.8 Apache Camel versions 4.15.0 through 4.18.3 Apache Camel versions 4.19.0 through 4.21.9 **Description** A relative path traversal issue exists in the `camel-azure-storage-blob` component. The `downloadBlobToFile` operation in the `BlobOperations.downloadBlobToFile()` function allows downloading Azure Storage blobs to the local filesystem using the `fileDir` endpoint option. Because the component joins `fileDir` with the remote blob name without lexical normalization or boundary checks, a blob name containing parent-directory segments can resolve to a location outside the intended directory. This allows an attacker who can influence blob names in a consumed container to create or overwrite files on the local system with the privileges of the Camel process. **Recommendations** Upgrade to version 4.14.9 for those on the 4.14.x LTS stream. Upgrade to version 4.18.4 for those on the 4.18.x stream. Upgrade to version 4.22.0. As a temporary mitigation, use the `regex` endpoint option to ensure only simple single-segment names are accepted, filtering out path separators or parent-directory segments. Avoid using the `downloadBlobToFile` operation on untrusted containers and instead use a file name controlled by the route. Treat blob names in externally writable containers as untrusted input and avoid deriving local filesystem paths from them.