CVE-2026-66907

Name of the Vulnerable Software and Affected Versions Apache Camel versions 4.0.0 through 4.14.8 Apache Camel versions 4.15.0 through 4.18.3 Apache Camel versions 4.19.0 through 4.21.9

Description A relative path traversal issue exists in the camel-google-storage consumer. When the downloadFileName option is used, the consumer downloads objects from Google Cloud Storage to the local filesystem. If the downloadFileName value contains no expression token, the system appends the remote object name to the destination path using the ${file:name} token. Because this token returns the file name verbatim without lexical normalization or boundary checks, an object name containing parent-directory segments (e.g., ../) can resolve to a location outside the intended directory. This allows an attacker who can control object names in the consumed bucket to create or overwrite files on the local filesystem with the privileges of the Camel process.

Recommendations Upgrade to version 4.22.0. Upgrade to version 4.14.9 for those on the 4.14.x LTS stream. Upgrade to version 4.18.4 for those on the 4.18.x stream. Set the filter option to a regular expression that only accepts simple single-segment object names to exclude those with path separators. Use an explicit expression for downloadFileName based on ${file:onlyname} instead of the implicit ${file:name}. Treat object names in externally writable buckets as untrusted input and avoid deriving local filesystem paths from them.