The Apache Camel LevelDB component's DefaultLevelDBSerializer class performs deserialization of data read from the LevelDB aggregation repository using java.io.ObjectInputStream without applying ObjectInputFilter or class-loading restrictions. This insecure deserialization allows attackers with write access to the LevelDB database files to inject malicious serialized Java objects. When these objects are deserialized during normal aggregation repository operations, they can trigger arbitrary code execution in the context of the application. The vulnerability affects multiple Apache Camel versions and has a CVSS 3.1 base score of 8.8, indicating high severity. Fixed versions have been released to address this issue.

Successful exploitation allows an attacker with write access to the LevelDB database files to execute arbitrary code within the application context. This can lead to full compromise of the affected application, including confidentiality, integrity, and availability impacts as indicated by the CVSS vector (Confidentiality: High, Integrity: High, Availability: High).

A fix is available. Users should upgrade to Apache Camel version 4.18.0 or later. For Long Term Support (LTS) releases, upgrade to 4.10.9 or 4.14.5 as appropriate. Applying these updates mitigates the vulnerability by correcting the deserialization process to prevent untrusted data exploitation.