The Apache Camel LevelDB component's DefaultLevelDBSerializer class insecurely deserializes data read from the LevelDB aggregation repository using java.io.ObjectInputStream without applying ObjectInputFilter or class-loading restrictions. This flaw allows attackers who can write to the LevelDB database files to inject malicious serialized Java objects. When these objects are deserialized during normal operations, they can trigger arbitrary code execution within the application context. The vulnerability affects Apache Camel versions 4.10.0 up to but not including 4.10.8, 4.14.0 up to but not including 4.14.5, and 4.15.0 up to but not including 4.18.0. The recommended remediation is to upgrade to Apache Camel 4.18.0 or later, or to the respective fixed LTS versions 4.10.9 and 4.14.5.

Successful exploitation allows an attacker with write access to the LevelDB database files to execute arbitrary code within the context of the Apache Camel application. This can lead to full compromise of the affected application, including confidentiality, integrity, and availability impacts. The CVSS v3.1 base score is 8.8 (High), reflecting network attack vector, low attack complexity, low privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

A fix is available. Users should upgrade to Apache Camel version 4.18.0 or later. For Long Term Support (LTS) branches, upgrade to 4.10.9 for the 4.10.x series and 4.14.5 for the 4.14.x series. These versions include the necessary patches to prevent unsafe deserialization. No alternative mitigations are specified in the vendor advisory; upgrading is the recommended action.