CVE-2026-66906: CWE-23 Relative path traversal in Apache Software Foundation Apache Camel
CVE-2026-66906 is a relative path traversal vulnerability in the Apache Camel Azure Storage Blob component. It allows an attacker who can influence blob names in an Azure Storage container to cause the Camel process to write files outside the intended directory on the local filesystem. This occurs because the component does not normalize or validate blob names before using them to construct local file paths. The issue affects multiple Apache Camel versions from 4.0.0 up to but not including fixed versions 4.14.9, 4.18.4, and 4.22.0. A fix is available in these versions. Users unable to upgrade immediately can mitigate by restricting blob names with regex filters or avoiding the vulnerable operation on untrusted containers.
AI Analysis
Technical Summary
The Apache Camel Azure Storage Blob component's downloadBlobToFile operation constructs local file paths by directly joining the configured fileDir with blob names retrieved from Azure Storage without lexical normalization or containment checks. Since Azure Storage blob names can include parent-directory segments, this allows a relative path traversal attack where files can be created or overwritten outside the intended directory with the privileges of the Camel process. The vulnerability affects Apache Camel versions from 4.0.0 before 4.14.9, from 4.15.0 before 4.18.4, and from 4.19.0 before 4.22.0. The issue is fixed in versions 4.14.9, 4.18.4, and 4.22.0. Mitigations include upgrading to fixed versions, using the regex endpoint option to filter blob names to simple single-segment names, or avoiding the downloadBlobToFile operation on untrusted containers.
Potential Impact
An attacker able to influence blob names in an Azure Storage container consumed by Apache Camel can cause the application to write files outside the configured directory on the local filesystem. This can lead to arbitrary file creation or overwriting with the privileges of the Camel process, potentially escalating to broader system compromise depending on file permissions and environment. The vulnerability undermines the integrity of the local filesystem and could be leveraged for privilege escalation or persistent code injection.
Mitigation Recommendations
A fix is available in Apache Camel versions 4.14.9, 4.18.4, and 4.22.0. Users are strongly recommended to upgrade to these versions. For those unable to upgrade immediately, apply the regex endpoint option to restrict blob names to simple single-segment names without path separators or parent-directory segments, preventing traversal. Additionally, avoid using the downloadBlobToFile operation on untrusted containers or write payloads to local files using route-controlled file names instead of blob names. Treat blob names from externally writable containers as untrusted input and do not derive local filesystem paths directly from them.
CVE-2026-66906: CWE-23 Relative path traversal in Apache Software Foundation Apache Camel
Description
CVE-2026-66906 is a relative path traversal vulnerability in the Apache Camel Azure Storage Blob component. It allows an attacker who can influence blob names in an Azure Storage container to cause the Camel process to write files outside the intended directory on the local filesystem. This occurs because the component does not normalize or validate blob names before using them to construct local file paths. The issue affects multiple Apache Camel versions from 4.0.0 up to but not including fixed versions 4.14.9, 4.18.4, and 4.22.0. A fix is available in these versions. Users unable to upgrade immediately can mitigate by restricting blob names with regex filters or avoiding the vulnerable operation on untrusted containers.
Affected software
pkg:maven/Apache Software Foundation/org.apache.camel:camel-azure-storage-blobRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The Apache Camel Azure Storage Blob component's downloadBlobToFile operation constructs local file paths by directly joining the configured fileDir with blob names retrieved from Azure Storage without lexical normalization or containment checks. Since Azure Storage blob names can include parent-directory segments, this allows a relative path traversal attack where files can be created or overwritten outside the intended directory with the privileges of the Camel process. The vulnerability affects Apache Camel versions from 4.0.0 before 4.14.9, from 4.15.0 before 4.18.4, and from 4.19.0 before 4.22.0. The issue is fixed in versions 4.14.9, 4.18.4, and 4.22.0. Mitigations include upgrading to fixed versions, using the regex endpoint option to filter blob names to simple single-segment names, or avoiding the downloadBlobToFile operation on untrusted containers.
Potential Impact
An attacker able to influence blob names in an Azure Storage container consumed by Apache Camel can cause the application to write files outside the configured directory on the local filesystem. This can lead to arbitrary file creation or overwriting with the privileges of the Camel process, potentially escalating to broader system compromise depending on file permissions and environment. The vulnerability undermines the integrity of the local filesystem and could be leveraged for privilege escalation or persistent code injection.
Mitigation Recommendations
A fix is available in Apache Camel versions 4.14.9, 4.18.4, and 4.22.0. Users are strongly recommended to upgrade to these versions. For those unable to upgrade immediately, apply the regex endpoint option to restrict blob names to simple single-segment names without path separators or parent-directory segments, preventing traversal. Additionally, avoid using the downloadBlobToFile operation on untrusted containers or write payloads to local files using route-controlled file names instead of blob names. Treat blob names from externally writable containers as untrusted input and do not derive local filesystem paths directly from them.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- apache
- Date Reserved
- 2026-07-28T09:25:00.103Z
- Cvss Version
- null
- State
- PUBLISHED
- Remediation Level
- null
- Is Cloud Service
- true
Threat ID: 6a8c7117acd9273b49d27da3
Added to database: 08/24/2026, 16:28:07 UTC
Last enriched: 08/24/2026, 16:37:38 UTC
Last updated: 08/24/2026, 17:40:37 UTC
Views: 18
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.