CVE-2026-79986

Name of the Vulnerable Software and Affected Versions Apache Camel versions 4.0.0 through 4.18.4 Apache Camel versions 4.19.0 through 4.22.0

Description An improper limitation of a pathname to a restricted directory, known as Path Traversal, exists in the Apache Camel Azure Files component. The issue occurs because remote-file consumers build absolute remote paths by concatenating the configured directory with file names from the server's directory listing without lexical normalization or containment checks. This allows a malicious or compromised remote server, or an on-path attacker, to provide a listing entry that resolves to a path outside the configured polling directory. Consequently, the application may read, delete, or rename files outside the intended directory using the endpoint's credentials. This flaw affects operations handled by FtpUtils.absoluteFilePath and GenericFileConsumer, impacting functions such as FtpOperations.retrieveFile, GenericFileDeleteProcessStrategy, and GenericFileProcessStrategySupport. The jailStartingDirectory option failed to constrain these remote operands.

Recommendations Upgrade to Apache Camel version 4.23.0. For the 4.22.x release stream, upgrade to version 4.22.1. For the 4.18.x LTS release stream, upgrade to version 4.18.5.