CVE-2026-91858: CWE-611 Improper Restriction of XML External Entity Reference in Apache Software Foundation Apache Camel

The vulnerability arises in Apache Camel's FopProducer, which transforms XSL-FO messages using a TransformerFactory instance created via TransformerFactory.newInstance() with FEATURE_SECURE_PROCESSING enabled. While the JDK's built-in transformer disables access to external DTDs and stylesheets, third-party TransformerFactory implementations like Saxon-HE do not enforce these restrictions. If such a factory is on the classpath, external entities declared in the XSL-FO document are resolved and expanded during transformation. This can lead to disclosure of files accessible by the Camel process or cause the process to make network requests to attacker-specified hosts. Apache Camel does not bundle such factories by default and excludes Xalan, so default setups are unaffected. The issue is only exploitable when an alternative JAXP TransformerFactory is present. Versions 4.14.x and earlier are end-of-life and unpatched. Affected versions are >=4.0.0 <4.18.5 and >=4.19.0 <4.22.1.

An attacker who can supply XSL-FO documents to the vulnerable Apache Camel FopProducer may exploit this vulnerability to read local files accessible by the Camel process or cause the process to make network requests to arbitrary hosts. This can lead to sensitive information disclosure (confidentiality impact) and limited integrity impact. Availability is not affected. The vulnerability requires the presence of a third-party JAXP TransformerFactory on the classpath that does not restrict external entity resolution, which is not the default configuration.

No official patch is currently available for affected versions. Versions on the 4.14.x line and earlier are end-of-life and do not receive fixes. Mitigation involves avoiding the presence of third-party JAXP TransformerFactory implementations such as Saxon-HE on the classpath when using camel-fop, or upgrading to a fixed version once available. Monitor the Apache Camel vendor advisories for updates on official fixes. In default deployments using the JDK transformer, this issue does not occur.