CVE-2026-114370: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in Red Hat Red Hat build of Apache Camel for Spring Boot 4

The vulnerability exists in the PathResourceManager component responsible for serving static files. The validation mechanism for symbolic links is insufficient, as it only verifies that the target path begins with an expected string rather than confirming a full directory name match. This can enable an attacker to traverse to sibling directories if their names share the initial characters of an authorized directory, potentially exposing unauthorized files.

The impact is limited to information disclosure of files outside the intended directory due to improper path validation. The CVSS score of 3.7 (low severity) reflects that the vulnerability requires network access with high attack complexity and no privileges, but only results in limited confidentiality impact without integrity or availability effects.

No explicit patch or remediation details are provided in the vendor advisory. Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-114370 for current remediation guidance.