The vulnerability arises from the camel-azure-storage-datalake component's downloadToFile operation, which constructs local file paths by joining a configured directory (fileDir) with remote file names reported by the Azure SDK without lexical normalization or containment checks. Since the remote file names are taken verbatim from the Azure Data Lake filesystem and can include parent-directory segments, this allows writing files outside the intended directory. This can lead to arbitrary file creation or overwriting with the privileges of the Camel process, potentially escalating impact depending on file system permissions. Other Apache Camel file-download consumers enforce directory containment, but this component did not until fixed. The flaw affects Apache Camel versions 4.0.0 up to but not including 4.14.9, 4.15.0 up to but not including 4.18.4, and 4.19.0 up to but not including 4.22.0.

An attacker able to influence file names in the Azure Data Lake filesystem consumed by Apache Camel can cause files to be created or overwritten outside the intended download directory. This can lead to loss of file integrity and potentially escalate to broader system compromise depending on the privileges of the Camel process and the writable locations on the host filesystem.

A fix is available in Apache Camel versions 4.14.9, 4.18.4, and 4.22.0. Users are strongly recommended to upgrade to these versions. For those unable to upgrade immediately, it is advised to constrain the file names processed by the consumer using the regex endpoint option to filter out any names containing path separators or parent-directory segments. Alternatively, avoid using the downloadToFile operation on untrusted filesystems and instead write payloads under controlled file names. Treat all object names from externally writable Data Lake filesystems as untrusted input and do not derive local filesystem paths directly from them.