CVE-2026-103412: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in Apache Software Foundation Apache Camel Karavan

Apache Camel Karavan versions >=3.18.0 and <4.22.1 are affected by a CWE-22 path traversal vulnerability. The vulnerability arises because a project file name supplied via the project file API is used verbatim as a path segment when writing the project to the working copy for a Git commit. If the file name contains '../' sequences, the file content can be written outside the project directory to any location writable by the Karavan process. An authenticated user of any role can exploit this to overwrite application configuration or files on the application classpath, enabling code execution in the Karavan container. The vulnerability has a CVSS 3.1 score of 8.8, indicating high severity. The issue is resolved in Apache Camel Karavan version 4.22.1.

An authenticated user with any role can exploit this vulnerability to write files outside the intended directory, overwriting critical application configuration or classpath files. This can lead to remote code execution within the Karavan container, compromising the integrity and availability of the application.

Users should upgrade Apache Camel Karavan to version 4.22.1 or later, where this path traversal vulnerability is fixed. No other mitigations are specified. Patch status is confirmed fixed in 4.22.1.