Improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Apache Camel Karavan. (CVE-2026-103412)

The vulnerability in Apache Camel Karavan arises from improper limitation of a pathname to a restricted directory (CWE-22). When a project file name is supplied via the project file API, it is used verbatim as a path segment during Git commit operations. If the file name includes '../' sequences, the file content can be written outside the project directory to any location writable by the Karavan process. This allows an authenticated user of any role to overwrite critical files, including application configuration or files on the application classpath, potentially leading to remote code execution within the Karavan container. The affected versions are from 3.18.0 before 4.22.1, with the vulnerability fixed in version 4.22.1.

An authenticated user can exploit this vulnerability to write files outside the intended directory, overwriting application configuration or classpath files. This can lead to arbitrary code execution within the Karavan container, posing a high risk to the confidentiality, integrity, and availability of the affected system.

Users should upgrade Apache Camel Karavan to version 4.22.1 or later, where this vulnerability is fixed. No other mitigations are specified. Patch status is confirmed by the vendor advisory.