CVE-2026-66906: CWE-23 Relative path traversal in Apache Software Foundation Apache Camel

The Apache Camel Azure Storage Blob component's downloadBlobToFile operation constructs local file paths by directly joining the configured fileDir with blob names obtained from Azure Storage without lexical normalization or containment checks. Because Azure Storage blob names can include parent-directory segments, this allows a relative path traversal that can cause files to be created or overwritten outside the intended directory, with the privileges of the Camel process. The vulnerability affects Apache Camel versions >=4.0.0 <4.14.9, >=4.15.0 <4.18.4, and >=4.19.0 <4.22.0. The issue is fixed in Apache Camel 4.14.9, 4.18.4, and 4.22.0. Mitigations include upgrading to these versions, filtering blob names using the regex endpoint option to exclude path separators or parent-directory segments, or avoiding the downloadBlobToFile operation on untrusted containers.

An attacker able to influence blob names in an Azure Storage container consumed by Apache Camel can cause arbitrary files to be created or overwritten outside the configured download directory on the local filesystem. This can lead to loss of file integrity and potentially escalate to further compromise depending on the permissions of the Camel process and the files overwritten. The vulnerability has a CVSS 3.1 score of 9.1 (critical), indicating high confidentiality and integrity impact without availability impact.

A fix is available. Users should upgrade to Apache Camel versions 4.14.9, 4.18.4, or 4.22.0 depending on their release stream. For deployments unable to upgrade immediately, users can mitigate by configuring the regex endpoint option to restrict blob names to simple single-segment names without path separators or parent-directory segments, preventing traversal. Alternatively, avoid using the downloadBlobToFile operation on untrusted containers and instead write payloads under controlled file names. Treat blob names from externally writable containers as untrusted input and do not derive local filesystem paths directly from them.