CVE-2026-79983

Name of the Vulnerable Software and Affected Versions Apache Camel versions 4.0.0 through 4.18.4 Apache Camel versions 4.19.0 through 4.22.0

Description A path traversal issue exists in the Apache Camel FTP component affecting ftp, ftps, and sftp schemes. The remote-file consumers build absolute remote paths by concatenating the configured directory with file names from the server's directory listing without lexical normalization or containment checks. This allows a malicious or compromised remote server, or an on-path attacker manipulating the LIST response, to force Camel to read, delete, or rename files outside the intended polling directory using the endpoint's credentials. The issue occurs within FtpUtils.absoluteFilePath and GenericFileConsumer, affecting operations such as retrieval via FtpOperations.retrieveFile and SftpOperations, deletion via GenericFileDeleteProcessStrategy, and renaming via GenericFileProcessStrategySupport and GenericFileRenameExclusiveReadLockStrategy. The jailStartingDirectory option failed to constrain these remote operands.

Recommendations Upgrade to version 4.23.0. For versions 4.22.x, upgrade to 4.22.1. For versions 4.18.x LTS, upgrade to 4.18.5.