CVE-2026-66906

Name of the Vulnerable Software and Affected Versions Apache Camel versions 4.0.0 through 4.14.8 Apache Camel versions 4.15.0 through 4.18.3 Apache Camel versions 4.19.0 through 4.21.9

Description A relative path traversal issue exists in the camel-azure-storage-blob component. The downloadBlobToFile operation in the BlobOperations.downloadBlobToFile() function allows downloading Azure Storage blobs to the local filesystem using the fileDir endpoint option. Because the component joins fileDir with the remote blob name without lexical normalization or boundary checks, a blob name containing parent-directory segments can resolve to a location outside the intended directory. This allows an attacker who can influence blob names in a consumed container to create or overwrite files on the local system with the privileges of the Camel process.

Recommendations Upgrade to version 4.14.9 for those on the 4.14.x LTS stream. Upgrade to version 4.18.4 for those on the 4.18.x stream. Upgrade to version 4.22.0. As a temporary mitigation, use the regex endpoint option to ensure only simple single-segment names are accepted, filtering out path separators or parent-directory segments. Avoid using the downloadBlobToFile operation on untrusted containers and instead use a file name controlled by the route. Treat blob names in externally writable containers as untrusted input and avoid deriving local filesystem paths from them.