CVE-2026-60093: CWE-23 Relative path traversal in Apache Software Foundation Apache Camel

The vulnerability (CWE-23) in Apache Camel's camel-azure-storage-datalake component arises because the downloadToFile operation constructs local file paths by directly joining the configured fileDir with remote file names from Azure Data Lake Storage Gen2 without lexical normalization or containment checks. Since the remote file names are enumerated from the Data Lake filesystem and not filtered by default, names containing parent-directory segments (e.g., '..') can cause files to be written outside the intended directory. This allows an attacker with influence over the Data Lake filesystem contents to overwrite arbitrary files on the local filesystem with the privileges of the Camel process. Other Camel file-download components enforce directory containment checks, but this component did not until fixed. The issue is fixed in Apache Camel 4.22.0, 4.14.9 (LTS), and 4.18.4. Workarounds include filtering path names with a regex to exclude path separators or parent-directory segments or avoiding downloadToFile on untrusted filesystems.

An attacker able to influence file names in the Azure Data Lake filesystem consumed by Apache Camel can cause the application to write files outside the intended directory, potentially overwriting arbitrary files with the privileges of the Camel process. This can lead to loss of integrity of local files and possibly escalate to further impact depending on the permissions of the Camel process. The vulnerability does not impact confidentiality or availability directly but has a high impact on integrity.

A fix is available in Apache Camel versions 4.22.0, 4.14.9 (LTS), and 4.18.4. Users are strongly recommended to upgrade to these versions to remediate the vulnerability. For deployments unable to upgrade immediately, mitigate by using the regex endpoint option to restrict consumed file names to simple single-segment names without path separators or parent-directory segments, preventing path traversal. Alternatively, avoid using the downloadToFile operation on untrusted filesystems and instead write payloads under route-controlled file names. Treat all object names in externally writable Data Lake filesystems as untrusted input and do not derive local filesystem paths directly from them.