The Apache Camel Google Storage consumer downloads objects from Google Cloud Storage to the local filesystem using the downloadFileName option. When this option is set without expression tokens, the consumer appends the remote object name directly to the configured path without lexical normalization or containment checks. Since Google Cloud Storage object names can include parent-directory segments (e.g., '../'), this allows an attacker who can influence object names in the bucket to cause files to be created or overwritten outside the intended directory. This path traversal vulnerability affects Apache Camel versions 4.0.0 up to but not including 4.14.9, 4.15.0 up to but not including 4.18.4, and 4.19.0 up to but not including 4.22.0. The flaw is limited to the consumer component and does not affect producers. The issue is fixed in versions 4.14.9, 4.18.4, and 4.22.0. Mitigations include upgrading to fixed versions, applying a filter to restrict object names to simple single-segment names, or using an explicit expression for downloadFileName that avoids passing the remote path. Users should treat object names in externally writable buckets as untrusted input.

An attacker able to influence object names in a Google Cloud Storage bucket consumed by Apache Camel can cause the consumer to write files outside the configured download directory. This can lead to arbitrary file creation or overwriting with the privileges of the Camel process, potentially resulting in loss of file integrity or escalation of impact depending on the writable locations accessible to the process. The vulnerability is limited to the consumer component of the camel-google-storage integration and does not affect producers or other Camel file-download consumers.

A fix is available in Apache Camel versions 4.14.9, 4.18.4, and 4.22.0. Users are strongly recommended to upgrade to one of these versions. For deployments that cannot upgrade immediately, users should set the filter option to a regular expression that only accepts simple single-segment object names, excluding any names containing path separators or parent-directory segments. Alternatively, users can configure downloadFileName with an explicit expression that does not propagate the remote path, such as using ${file:onlyname}. As a defense in depth, treat object names in externally writable buckets as untrusted input and avoid deriving local filesystem paths directly from them.